cvelistv5 - cve-2018-10251

cve-2018-10251

Vulnerability from cvelistv5

Published

2018-05-04 20:00

Modified

2024-08-05 07:32

Severity ?

Summary

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges.

References

▼	URL	Tags
	cve@mitre.org	https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251/	Mitigation, Vendor Advisory

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:32:01.647Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-04-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-04T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-10251",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251/",
              "refsource": "CONFIRM",
              "url": "https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-10251",
    "datePublished": "2018-05-04T20:00:00",
    "dateReserved": "2018-04-20T00:00:00",
    "dateUpdated": "2024-08-05T07:32:01.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-10251\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-05-04T20:29:00.517\",\"lastModified\":\"2019-10-03T00:03:26.223\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en los routers Sierra Wireless AirLink GX400, GX440, ES440 y LS300 con firmware en versiones anteriores a la 4.4.7 y los routers GX450, ES450, RV50, RV50X, MP70 y MP70E con firmware en versiones anteriores a la 4.9.3 podr\u00eda permitir que un atacante remoto no autenticado ejecute c\u00f3digo arbitrario y obtenga el control total de un sistema afectado, incluyendo el env\u00edo de comandos con privilegios root.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":10.0},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":true,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1188\"},{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sierrawireless:es440:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2098BAB-AF80-4C32-A5B8-FD6296C74110\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sierrawireless:gx400:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CBA7B93-E1C2-41C6-B21E-6DA8B568D751\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sierrawireless:gx440:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"15DD2CF2-3A83-4ED7-BCD8-05F60782AE17\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sierrawireless:ls300:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F4A4F52-F99E-4F72-8A2C-8D2CC21461BD\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.4.7\",\"matchCriteriaId\":\"233FE30D-5ACB-4932-8551-95472B1017A2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sierrawireless:es450:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"524DF1AE-21F2-4AA6-99E7-6F98304FF845\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sierrawireless:gx450:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C12CF71-FE0E-44EA-9F2E-7CFB42E7C216\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sierrawireless:mp70:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"007D4629-4BE2-4C7A-AC8B-E87739E22D12\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sierrawireless:mp70e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"47DBB86D-8089-4A6C-8485-5E5CB400645F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sierrawireless:rv50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54218BC7-D942-4907-8052-ECB308753162\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sierrawireless:rv50x:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61D3EF27-E823-4E49-BD58-D050EB02D294\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.9.3\",\"matchCriteriaId\":\"8E1735B2-A306-408A-A30C-7014E7C79354\"}]}]}],\"references\":[{\"url\":\"https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2018-10251

Vulnerability from cvelistv5

gsd-2018-10251

Vulnerability from gsd

var-201805-0371

Vulnerability from variot

ghsa-fwv8-jff3-8mm6

Vulnerability from github

Tags

Sightings

Nomenclature