CVE-2018-4063
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
Description
CVE-2018-4063 is a high-severity remote code execution vulnerability in the upload.cgi functionality of Sierra Wireless AirLink ES450 running firmware version 4.9.3. With a CVSS v3.1 base score of 8.8, this flaw allows an authenticated attacker to upload a file containing executable code to the device's webserver, where it becomes routable and can be executed remotely. The vulnerability stems from unrestricted file upload capabilities in the ACEManager web interface. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 2, 2026, and has an EPSS score of 0.00802 (73.8th percentile), indicating a notably elevated exploitation probability for a vulnerability of this age.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sierrawireless | aleos | < 4.4.9; < 4.11.0; < 4.9.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/152648/Sierra-Wireless-AirLink-ES450-ACEManager-upload.cgi-Remote-Code-Execution.html(Exploit, VDB Entry)
- http://www.securityfocus.com/bid/108147(Broken Link)
- https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03(Third Party Advisory, US Government Resource)
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0748(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4063(US Government Resource)
- https://www.forescout.com/blog/ot-network-security-threats-industrial-routers-under-attack/(Exploit, Third Party Advisory)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2018-4063 is classified under CWE-434, which describes a condition where an application allows users to upload files without properly validating the file type, content, or destination. In the case of the Sierra Wireless AirLink ES450, the upload.cgi endpoint in the ACEManager web interface accepts file uploads without verifying that the uploaded file is a safe type. This allows an attacker to upload executable scripts or binaries that the webserver can then serve and execute. Unrestricted file upload vulnerabilities are particularly dangerous on embedded devices and IoT gateways because these devices often run with elevated privileges, lack sophisticated security controls, and are difficult to monitor for compromise. Learn more about CWE-434
Impact Analysis
Confidentiality, Integrity, and Availability are all rated as high impact (C:H/I:H/A:H). Successful exploitation allows the attacker to execute arbitrary code on the AirLink device, granting full control over the cellular gateway. This enables reading sensitive configuration data including cellular network credentials and VPN settings, modifying device behavior and routing rules, and disrupting connectivity for all devices relying on the gateway.
Business Impact is significant for organizations deploying Sierra Wireless AirLink devices in critical infrastructure, industrial control systems, fleet management, and remote site connectivity. These devices often serve as the sole network connection for remote locations such as utility substations, retail point-of-sale systems, and industrial facilities. Compromise of the gateway can enable an attacker to intercept all traffic passing through the device, pivot into connected operational technology networks, and disrupt essential services.
Exploitation Probability remains elevated despite the vulnerability's age. The EPSS score of 0.00802 (73.8th percentile) indicates that exploitation is more likely than approximately 74% of all known vulnerabilities. Public exploit code is available through Packet Storm Security and Talos Intelligence, lowering the barrier for exploitation. The vulnerability's inclusion in the CISA KEV catalog in 2025, years after its initial disclosure, suggests renewed exploitation activity targeting legacy deployments.
Exploit Maturity
CVE-2018-4063 has confirmed active exploitation, as evidenced by its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 2, 2026. The late addition to KEV, several years after the vulnerability was originally disclosed in 2018, indicates that threat actors are actively targeting legacy Sierra Wireless AirLink deployments that remain unpatched.
Public exploit code is readily available. Packet Storm Security has published a full exploit demonstrating remote code execution through the upload.cgi endpoint, and Cisco Talos has documented the vulnerability in detail as TALOS-2018-0748. The EPSS score of 0.00802 (73.8th percentile) reflects sustained exploitation interest. The vulnerability requires authentication (PR:L), which slightly raises the bar for exploitation, but default or weak credentials on IoT devices are common and frequently targeted. The ransomware association is listed as "Unknown" by CISA, though IoT gateways compromised through this vulnerability can serve as persistent access points into otherwise isolated networks.
Remediation
-
Upgrade Sierra Wireless AirLink ALEOS Firmware — Update to ALEOS firmware version 4.9.4, 4.11.0, or 4.4.9 or later, depending on your device model and firmware branch. Consult the ICS-CERT advisory ICSA-19-122-03 for the complete list of fixed firmware versions and applicable device models.
-
Change Default and Weak Credentials — Immediately change the administrative password on all Sierra Wireless AirLink devices. The vulnerability requires authentication, so strong, unique credentials significantly reduce the risk of exploitation. Disable any default accounts that are not required for operation.
-
Restrict ACEManager Web Interface Access — Limit access to the ACEManager web interface to trusted management networks only. Use firewall rules or VPN-based access to ensure the web interface is not reachable from untrusted networks or the public internet.
-
Implement Network Monitoring for IoT Devices — Deploy monitoring for unusual traffic patterns from AirLink devices, including unexpected outbound connections, file uploads to the webserver, and anomalous HTTP requests to the upload.cgi endpoint. IoT devices often lack endpoint security agents, making network-based monitoring essential.
-
Evaluate Device End-of-Life Status — For older AirLink ES450 devices, verify that the device is still receiving firmware updates from Sierra Wireless. If the device has reached end-of-life, plan for replacement with a supported model that receives regular security patches.
Technical Details
CVE-2018-4063 targets the upload.cgi endpoint in the ACEManager web interface of Sierra Wireless AirLink ES450 devices running ALEOS firmware version 4.9.3. The ACEManager provides a web-based management interface for configuring and monitoring the cellular gateway, and the upload.cgi script handles file upload operations.
CVSS Vector Breakdown: The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector indicates high severity with a low-privilege authentication requirement. Attack Vector (AV:N) means the vulnerability is exploitable remotely over the network. Attack Complexity (AC:L) indicates no special conditions are required. Privileges Required (PR:L) means the attacker needs valid low-level credentials to access the ACEManager interface. User Interaction (UI:N) means no legitimate user action is needed. Scope (S:U) is unchanged. Confidentiality, Integrity, and Availability (C:H/I:H/A:H) are all maximally impacted.
Attack Mechanism: The attacker authenticates to the ACEManager web interface using valid credentials (which may be default credentials or credentials obtained through other means). They then send a specially crafted HTTP request to the upload.cgi endpoint containing a file with executable content, such as a shell script or compiled binary. The upload.cgi script processes the file upload without validating the file type or content, placing it in a location on the webserver where it becomes accessible and executable. The attacker can then request the uploaded file through the webserver to trigger execution, gaining code execution on the underlying Linux-based operating system with the privileges of the web server process.
Frequently Asked Questions
Why was CVE-2018-4063 added to the KEV catalog years after disclosure?
CISA adds vulnerabilities to the KEV catalog based on evidence of active exploitation, not based on disclosure date. The addition in 2025 with a remediation deadline of January 2, 2026 indicates that threat actors have been observed actively exploiting this vulnerability in legacy Sierra Wireless AirLink deployments that remain unpatched.
Does CVE-2018-4063 require authentication to exploit?
Yes, the vulnerability requires low-level authentication (PR:L) to access the ACEManager web interface. However, many IoT and embedded devices retain default credentials, and attackers frequently target these devices with credential stuffing and brute-force attacks, making the authentication requirement less of a barrier than it might be for enterprise applications.
Which Sierra Wireless AirLink devices are affected?
The vulnerability was originally discovered in the AirLink ES450 running ALEOS firmware 4.9.3, but the affected firmware versions include ALEOS prior to 4.4.9, 4.9.4, and 4.11.0, suggesting multiple AirLink models using the ALEOS operating system may be vulnerable.
Is public exploit code available for CVE-2018-4063?
Yes. Full exploit details are available through Packet Storm Security and Cisco Talos Intelligence (TALOS-2018-0748). The availability of public exploit code significantly lowers the barrier for exploitation and increases the urgency of patching.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.