CVE-2019-11849

EUVD-2019-3509 · Published Aug 21, 2020

A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution.

Technologies

Sierrawireless Airlink Mp70Sierrawireless Airlink Lx40Sierrawireless Airlink Rv50Sierrawireless Airlink Lx60Sierrawireless Airlink Rv50XSierrawireless AleosSierrawireless Airlink Mp70E

Weaknesses

CWE-787

CVSS scores

v3.16.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
v2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Privilege Escalation

T1068Exploitation for Privilege Escalation

References

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/

Potentially impacted assets

See if this affects your attack surface