Sierrawireless Aleos Firmware vulnerabilities

CVE-2016-5065 [CRITICAL] CWE-77 CVE-2016-5065: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command inj Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection.

CVE-2016-5068 [CRITICAL] CWE-287 CVE-2016-5068: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_ Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.

CVE-2016-5067 [HIGH] CWE-77 CVE-2016-5067: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection. Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection.

CVE-2016-5071 [HIGH] CWE-264 CVE-2016-5071: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as r Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root.

CVE-2016-5066 [CRITICAL] CWE-255 CVE-2016-5066: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, scon Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.

CVE-2016-5070 [CRITICAL] CWE-255 CVE-2016-5070: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext. Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext.

CVE-2016-5069 [CRITICAL] CWE-613 CVE-2016-5069: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.