Sierra Wireless AirLink Router with ALEOS Software

Risk Summary

Successful exploitation of these vulnerabilities could allow a loss of sensitive information and could allow remote code execution.

CVEs (2)

Remediations

• Upgrade MP70, RV50, RV50x, RV55, LX 40, LX60 to ALEOS version 4.16.0 or later
• Upgrade ES450, GX450 to ALEOS version 4.9.8 (when available) or later
• Always use strong, and ideally unique random credentials for devices. ALEOS devices ship with unique random credentials by default.
• Disable access to ACEManager on the wide area network (WAN) and use the Sierra Wireless Airlink Management System (ALMS) or an alternative device management platform for remote management of ALEOS devices.
• If the ACEManager must remain accessible via the WAN, restrict access using measures such as Private APN, VPN, or the ALEOS Trusted IP feature (restricts access to specific hosts).

Affected Vendors

Affected Products (2)

Affected Sectors

Multiple