An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3
Published May 6, 2019 ·Due Jan 2, 2026
8.8
HIGHCVSS 3.1
EPSS 27.06%
Description
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Affected products
- Vendor n/a Product Sierra Wireless Defaultn/a
- Version Sierra Wireless AirLink ES450 FW 4.9.3StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Sierra Wireless | n/a |
|
Configuration 1
- < 4.4.9
Running on/with
- n/a
- n/a
- n/a
- n/a
Configuration 2
- < 4.11.0
Running on/with
- n/a
- n/a
- n/a
- n/a
- n/a
- n/a
Configuration 3
- < 4.9.4
Running on/with
- n/a
- n/a
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:S/C:C/I:C/A:C
Date Added
Dec 12, 2025
Patch Due
Jan 2, 2026
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
ActiveAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Dec 13, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (16 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 27.06% (0.27059) | 97.99th | v5 (v2026.06.15) |
| Jun 15, 2026 | 28.06% (0.28056) | 97.85th | v5 (v2026.06.15) |
| Dec 16, 2025 | 1.71% (0.01708) | 81.84th | v4 (v2025.03.14) |
| Dec 13, 2025 | 4.29% (0.04294) | 88.46th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.16% (0.00161) | 34.42th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.52% (0.00521) | 77.62th | v3 (v2023.03.01) |
| Apr 29, 2024 | 0.52% (0.00521) | 76.58th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.50% (0.00503) | 75.75th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.50% (0.00503) | 72.78th | v3 (v2023.03.01) |
| Mar 6, 2023 | 4.57% (0.04571) | 88.92th | v2 (v2022.01.01) |
| Apr 1, 2022 | 4.57% (0.04571) | 87.83th | v2 (v2022.01.01) |
| Feb 4, 2022 | 4.57% (0.04571) | 74.15th | v2 (v2022.01.01) |
| Feb 3, 2022 | 2.42% (0.02418) | 53.87th | v1 |
| Jan 6, 2022 | 2.42% (0.02418) | 53.42th | v1 |
| Sep 1, 2021 | 2.42% (0.02418) | 78.36th | v1 |
| Apr 14, 2021 | 2.42% (0.02418) | 0.00th | v1 |
References (6)
- http://packetstormsecurity.com/files/152648/Sierra-Wireless-AirLink-ES450-ACEManager-upload.cgi-Remote-Code-Execution.html x_refsource_MISCExploitVDB Entry
- http://www.securityfocus.com/bid/108147 vdb-entryx_refsource_BIDBroken Link
- https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03 x_refsource_MISCThird Party AdvisoryUS Government Resource
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0748 x_refsource_MISCExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4063 government-resourceUS Government Resource
- https://www.forescout.com/blog/ot-network-security-threats-industrial-routers-under-attack/ third-party-advisoryExploitThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/152648/Sierra-Wireless-AirLink-ES450-ACEManager-upload.cgi-Remote-Code-Execution.html | x_refsource_MISCExploitVDB Entry | |
| http://www.securityfocus.com/bid/108147 | vdb-entryx_refsource_BIDBroken Link | |
| https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03 | x_refsource_MISCThird Party AdvisoryUS Government Resource | |
| https://talosintelligence.com/vulnerability_reports/TALOS-2018-0748 | x_refsource_MISCExploitThird Party Advisory | |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4063 | government-resourceUS Government Resource | |
| https://www.forescout.com/blog/ot-network-security-threats-industrial-routers-under-attack/ | third-party-advisoryExploitThird Party Advisory |
Change history (0)
No recorded changes yet.