CVE-2018-4069

Vulnerability

An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 firmware version 4.9.3. The ACEManager web server transmits user credentials in plaintext XML over HTTP when processing authentication requests to /xml/Connect.xml. This occurs because the communication channel is not encrypted, violating CWE-311 (Missing Encryption of Sensitive Data). The vulnerability affects the ES450 running FW 4.9.3, and by extension other AirLink ALEOS devices running versions prior to 4.9.4 (for GX450 and ES450) as indicated in ICSA-19-122-03 [2]. The vendor states the web application is not accessible by default from the Cellular WAN, meaning the attack surface is primarily on the local network side [3].

Exploitation

An attacker must have network access upstream from the device (i.e., be positioned to sniff traffic between the administrator and the ES450). No authentication is required on the attacker's part, but the attacker must be able to capture HTTP traffic destined for the ACEManager web server. The exploit step is simply passive listening: intercepting an HTTP POST request to /xml/Connect.xml that contains the administrator's credentials in cleartext XML. The attacker can then extract the login details from the captured request without any active manipulation [1][3].

Impact

Successful exploitation allows the attacker to obtain administrator credentials (username and password) for the ACEManager web interface. With these credentials, the attacker can authenticate to the device and gain full administrative access, which may lead to further compromise such as device reconfiguration, credential exposure, or pivoting to other systems on the network. The confidentiality of the credentials is directly breached, and successful logon grants the attacker an elevated privileged position on the device [2][3].

Mitigation

Sierra Wireless released firmware version 4.9.4 for the ES450 and GX450, which addresses this vulnerability by encrypting authentication traffic [2]. Users should upgrade to FW 4.9.4 or later. For devices that cannot be immediately patched, network segmentation should be employed to ensure that ACEManager is not accessible from untrusted networks, and administrators should only manage the device over a VPN or other encrypted channel. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date. No other workaround has been published [2][3].