CVE-2018-4073

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3

published May 6, 2019

CVSS
—
EPSS
26%
Percentile
97.9
In the wild
Unconfirmed
What it is

An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The the binary the endpoint /cgi-bin/Embeded_Ace_TLSet_Task.cgi is a very similar endpoint that is designed for use with setting table values that can cause an arbitrary setting writes, resulting in the unverified changes to any system setting. An attacker can make an authenticated HTTP request, or run the binary as any user, to trigger this vulnerability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.25634 · 97.9th percentile
Published
2019-05-06T18:22Z
EPSS history
Timeline
  • 22 SEP 03:16Z
    EPSS moved 26% → 14%
    epss
  • 06 SEP 03:12Z
    EPSS moved 26% → 14%
    epss
  • 30 AUG 16:01Z
    EPSS moved 14% → 26%
    epss
  • 29 AUG 04:40Z
    EPSS moved 26% → 14%
    epss
  • 06 MAY 18:22Z
    An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3
    cvelistv5