Unrestricted file upload in Sierra Wireless
Priority CRITICAL 97Exploited in the wildCWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-434.
Summary
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Why it matters now
Exploitation Active In CISA KEV since 2025-12-12CISA due date 2026-01-02
EPSS 0.2726 98th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Sierra Wireless | Sierra Wireless AirLink ES450 FW 4.9.3 | — | No fix listed | CNA |
- Sierra Wireless Vendor— Affected Sierra Wireless AirLink ES450 FW 4.9.3 Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* | before 4.4.9 | Vulnerable | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_es440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_gx400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_gx440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_ls300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
| cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* | before 4.11.0 | Vulnerable | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_lx40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_lx60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_mp70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_mp70e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
- cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* Versions before 4.4.9 Vulnerable ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_es440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_gx400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_gx440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_ls300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
- cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* Versions before 4.11.0 Vulnerable ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_lx40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_lx60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_mp70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_mp70e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:sierrawireless:airlink_rv50:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_rv50x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
| cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* | before 4.9.4 | Vulnerable | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_es450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
| cpe:2.3:h:sierrawireless:airlink_gx450:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SierraWireless |
- cpe:2.3:h:sierrawireless:airlink_rv50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_rv50x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
- cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* Versions before 4.9.4 Vulnerable ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_es450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
- cpe:2.3:h:sierrawireless:airlink_gx450:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SierraWireless
Remediation
No fixed version listed by the sources yet.
Timeline
- 2025-12-12 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2018-4063
- 2026-10-03 Alias added: GHSA-96pr-35f4-cf4c
References
Exploit 3
More Sierra Wireless vulnerabilities
- TI-2017-03954 Improper authorization in Sierra Wireless AirLink Raven XE and XT CVSS 3.0CRITICAL 9.8
- TI-2017-03952 Cross-site request forgery in Sierra Wireless AirLink Raven XE and XT CVSS 3.0HIGH 8.8
- TI-2020-10748 MGOS Command Injection CVSS 3.1HIGH 7.8
- TI-2023-14963 Improper authentication in Sierra Wireless AirVantage, AirVantage-Capable Devices: All… CVSS 3.1HIGH 8.1
- TI-2017-03956 Insufficiently protected credentials in Sierra Wireless AirLink Raven XE and XT CVSS 3.0HIGH 7.5
- TI-2023-14964 Exposure of Sensitive Information to an Unauthorized Actor CVSS 3.1MEDIUM 5.3
Sources
- CVE-2018-4063 · CVE Program
- CVE-2018-4063 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-96pr-35f4-cf4c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences