Critical severity · published Dec 26, 2022
CVE-2019-11851
The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary…
9.8
CVSS
1.8%
EPSS
No
On KEV
Description
The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary code via a buffer overflow.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
Aleos · Sierrawireless
4.10.0 before 4.14.0; 4.5.0 before 4.9.5; before 4.4.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11851
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11851
Vendor Advisory
http://source.sierrawireless.com/-/media/support_downloads/security-bulletins/pdf/swi-psa-2021-001.ashx
Vendor Advisory
https://www.sierrawireless.com/company/security/
More from Aleos
8.8
CVE-2018-4063
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
9.8
CVE-2020-8782
Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution
9.8
CVE-2019-11855
An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9
9.8
CVE-2018-10251
A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware…
9.1
CVE-2019-11852
An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9