CVE-2018-4068

Vulnerability

The ACEManager web server in Sierra Wireless AirLink ES450 firmware version 4.9.3 exposes the device's default configuration file at /defaults.xml without requiring any authentication [1]. This file contains all factory-reset settings, including the default administrative password in plain text. The vulnerability exists because the web server does not enforce access controls on this endpoint. The ACEManager is not accessible by default from the Cellular WAN, but it is reachable from the local network [1].

Exploitation

An attacker with network access to the ACEManager interface (typically on TCP port 9191) can send a simple unauthenticated HTTP GET request to /defaults.xml [1]. No prior authentication, user interaction, or special privileges are required. The request can be made using any HTTP client, such as a web browser or curl.

Impact

Successful exploitation results in disclosure of the device's default configuration, which includes the default administrative password in plain text [1]. This information could allow an attacker to gain administrative access to the device if the default credentials have not been changed. The impact is limited to information disclosure (CWE-200) with low confidentiality impact, as the attacker does not obtain live configuration or session data.

Mitigation

As of the publication date, no firmware update has been announced by Sierra Wireless to address this vulnerability [1]. Mitigation steps include restricting network access to the ACEManager interface to trusted networks only, changing the default administrative password immediately after device deployment, and monitoring for unauthorized access attempts. Users should contact Sierra Wireless for potential firmware updates.