High severity · published May 4, 2018
CVE-2017-15043
A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware…
8.8
CVSS
4.3%
EPSS
No
On KEV
Description
A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9 could allow an authenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. This vulnerability is due to insufficient input validation on user-controlled input in an HTTP request to the targeted device. An attacker in possession of router login credentials could exploit this vulnerability by sending a crafted HTTP request to an affected system.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Es440 Firmware · Sierrawireless
before 4.4.5 · source: NVD
EF
Es450 Firmware · Sierrawireless
before 4.9 · source: NVD
GF
Gx400 Firmware · Sierrawireless
before 4.4.5 · source: NVD
GF
Gx440 Firmware · Sierrawireless
before 4.4.5 · source: NVD
GF
Gx450 Firmware · Sierrawireless
before 4.9 · source: NVD
LF
Ls300 Firmware · Sierrawireless
before 4.4.5 · source: NVD
MF
Mp70 Firmware · Sierrawireless
before 4.9 · source: NVD
MF
Mp70e Firmware · Sierrawireless
before 4.9 · source: NVD
RF
Rv50 Firmware · Sierrawireless
before 4.9 · source: NVD
RF
Rv50x Firmware · Sierrawireless
before 4.9 · source: NVD