Skip to content
Fencer Intel
high 8.8

CVE-2018-4063 kev in the critical feed json

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.

published 2019-05-06 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-15849

cvss
8.8
version 3.1, CNA
cisa kev
Exploited
added 2025-12-12
epss
27.3%
EPSS 27.3% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  • sierrawireless aleos 4.4.9, 4.9.4, 4.11.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-19-122-03 updated cvss 9.1

Sierra Wireless AirLink ALEOS (Update B)

  • Sierra Wireless GX450 and ES450 < 4.9.4 Sierra Wireless LS300 GX400 GX440 and ES440 < 4.4.9 Sierra Wireless MP70 MP70E RV50 RV50X LX40 and LX60 < 4.12
    affected: mitigation “LS300, GX400, GX440, ES440: ALEOS 4.4.9 The ALEOS 4.4.9 Release Note is available (login required)” source.sierrawireless.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA SSVC: exploitation active
  4. CISA patch deadline

Known exploited

Added
10 mo ago
Patch by
2026-01-02 (10 mo ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product
Sierra Wireless, AirLink ALEOS
CISA name
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
10 mo ago

Exploit prediction

27.26% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • packetstormsecurity.com http://packetstormsecurity.com/files/152648/Sierra-Wireless-AirLink-ES450-ACEManager-upload.cgi-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
  • talosintelligence.com https://talosintelligence.com/vulnerability_reports/TALOS-2018-0748 referenced PoC, tagged "exploit" by a source, unverified
  • forescout.com https://www.forescout.com/blog/ot-network-security-threats-industrial-routers-under-attack/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

  • n/a Sierra Wireless

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.