Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.
Priority MEDIUM 46CWE-255Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.
Why it matters now
EPSS 0.01839 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 | Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 | — | No fix listed | CNA |
- Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 Vendor— Affected Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:sierrawireless:aleos_firmware:4.3.2:*:*:*:*:*:*:* | 4.3.2 | Vulnerable | SierraWireless |
| cpe:2.3:h:sierrawireless:gx_440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
- cpe:2.3:o:sierrawireless:aleos_firmware:4.3.2:*:*:*:*:*:*:* Versions 4.3.2 Vulnerable ·SierraWireless
- cpe:2.3:h:sierrawireless:gx_440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-5066
- 2026-10-03 Alias added: GHSA-6j4c-8497-9cm2
References
More SierraWireless Aleos Firmware vulnerabilities
- TI-2016-04382 Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection. CVSS 3.0CRITICAL 9.8
- TI-2016-04387 Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext. CVSS 3.0CRITICAL 9.8
- TI-2016-04386 Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL. CVSS 3.0CRITICAL 9.8
- TI-2016-04385 Improper authentication in Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 CVSS 3.0CRITICAL 9.8
- TI-2016-04384 Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection. CVSS 3.0HIGH 8.8
- TI-2016-04388 Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root. CVSS 3.0HIGH 8.8
Sources
- CVE-2016-5066 · CVE Program
- CVE-2016-5066 · NVD
- FIRST EPSS
- GHSA-6j4c-8497-9cm2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences