Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability.

Sierra Wireless · AirLink ALEOS

Exploitabilité (EPSS)

28.1 %

percentile mondial 98

Sévérité (CVSS)

8.8

CVSS v3.1

Ajoutée au KEV

12 déc. 2025

échéance CISA · 02 janv. 2026

Description

Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Action requise (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Familles de faiblesses

CWE-434 · Téléversement de fichier non restreint

Signal de priorisation (inspiré SSVC)

Examiner

Exploitation
Active (catalogue KEV)

Automatisable
Inconnu

Impact technique
Partiel

Orientation, pas une décision : le 4ᵉ facteur SSVC (impact mission/société) dépend du contexte de votre organisation. Méthode ↗

NVD ↗ CVE.org ↗ CISA KEV ↗