Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability

ÉLEVÉE 8.8EXPLOITED (CISA KEV)CVE-2018-4063 · Published 06/05/2019 · updated 17/06/2026

Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 12/12/2025. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
AirLink ALEOS Sierra Wireless	Versions not published yet (product named by CISA KEV)

Description

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

References

packetstormsecurity.com/files/152648/Sierra-Wireless-AirLink-ES450-ACEManager-upload.cgi-Remote-Code-Execution.html · Exploit
securityfocus.com/bid/108147 · Broken Link
ics-cert.us-cert.gov/advisories/ICSA-19-122-03 · Third Party Advisory
talosintelligence.com/vulnerability_reports/TALOS-2018-0748 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
forescout.com/blog/ot-network-security-threats-industrial-routers-under-attack · Exploit
CISA KEV · CVE-2018-4063

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free