CVE-2018-4063

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

Sierra Wireless

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

27.26% chance of exploitation in the next 30 days, 98th percentile

CISA KEV

added 2025-12-12

Published

2019-05-06

Updated

2026-05-22

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0748

Security advisories

• https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03
• https://www.forescout.com/blog/ot-network-security-threats-industrial-routers-under-attack
• http://www.securityfocus.com/bid/108147

References

• CVE Record
• NVD entry