CVE-2017-15043: A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, MP70, and MP70E…

PriorityP260high8.8CVSS 3.0

AVNACLPRLUINSUCHIHAH

EPSS

4.24%

89.8th percentile

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9 could allow an authenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. This vulnerability is due to insufficient input validation on user-controlled input in an HTTP request to the targeted device. An attacker in possession of router login credentials could exploit this vulnerability by sending a crafted HTTP request to an affected system.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
sierrawireless	es440_firmware	< 4.4.5	4.4.5
sierrawireless	es450_firmware	< 4.9	4.9
sierrawireless	gx400_firmware	< 4.4.5	4.4.5
sierrawireless	gx440_firmware	< 4.4.5	4.4.5
sierrawireless	gx450_firmware	< 4.9	4.9
sierrawireless	ls300_firmware	< 4.4.5	4.4.5
sierrawireless	mp70_firmware	< 4.9	4.9
sierrawireless	mp70e_firmware	< 4.9	4.9
sierrawireless	rv50_firmware	< 4.9	4.9
sierrawireless	rv50x_firmware	< 4.9	4.9

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.