Sign-up

ID

VAR-201508-0602


CVE

CVE-2015-2897


TITLE

Sierra Wireless GX, ES, and LS gateways running ALEOS contain hard-coded credentials

Trust: 0.8

sources: CERT/CC: VU#628568

DESCRIPTION

Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a (1) SSH or (2) TELNET session. Sierra Wireless Provided by AirLink Management software running on the gateway device ALEOS Has a problem with hard-coded credentials. ALEOS version 4.3.4 And earlier, these root Authorized accounts are enabled by default, telnet Or ssh It is accessible at. ALEOS version 4.3.5 From 4.4.1 By default, hard-coded accounts are enabled, but remote access is disabled. CWE-259: Use of Hard-coded Password https://cwe.mitre.org/data/definitions/259.htmlA remote attacker could manipulate the affected device. Sierra Wireless ALEOS is prone to multiple privilege-escalation vulnerabilities. A remote attacker could exploit this vulnerability via an SSH or TELNET session to gain administrator access. The following devices are affected: AirLink ES, GX, LS

Trust: 2.7

sources: NVD: CVE-2015-2897 // CERT/CC: VU#628568 // JVNDB: JVNDB-2015-004031 // BID: 76264 // VULHUB: VHN-80858

AFFECTED PRODUCTS

vendor:sierrawirelessmodel:aleosscope:lteversion:4.4.1

Trust: 1.0

vendor:sierramodel: - scope: - version: -

Trust: 0.8

vendor:sierramodel:airlink es440scope: - version: -

Trust: 0.8

vendor:sierramodel:airlink es450scope: - version: -

Trust: 0.8

vendor:sierramodel:airlink gx400scope: - version: -

Trust: 0.8

vendor:sierramodel:airlink gx440scope: - version: -

Trust: 0.8

vendor:sierramodel:airlink gx450scope: - version: -

Trust: 0.8

vendor:sierramodel:airlink ls300scope: - version: -

Trust: 0.8

vendor:sierramodel:aleosscope:lteversion:4.4.1

Trust: 0.8

vendor:sierrawirelessmodel:aleosscope:eqversion:4.4.1

Trust: 0.6

vendor:sierramodel:wireless aleosscope:eqversion:4.4.1

Trust: 0.3

vendor:sierramodel:wireless aleosscope:eqversion:4.3.5

Trust: 0.3

vendor:sierramodel:wireless aleosscope:eqversion:4.3.4

Trust: 0.3

vendor:sierramodel:wireless airlink lsscope:eqversion:0

Trust: 0.3

vendor:sierramodel:wireless airlink gxscope:eqversion:0

Trust: 0.3

vendor:sierramodel:wireless airlink esscope:eqversion:0

Trust: 0.3

vendor:sierramodel:wireless aleosscope:neversion:4.4.2

Trust: 0.3

sources: CERT/CC: VU#628568 // BID: 76264 // JVNDB: JVNDB-2015-004031 // CNNVD: CNNVD-201508-047 // NVD: CVE-2015-2897

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2015-2897
value: HIGH

Trust: 1.6

nvd@nist.gov: CVE-2015-2897
value: HIGH

Trust: 1.0

CNNVD: CNNVD-201508-047
value: CRITICAL

Trust: 0.6

VULHUB: VHN-80858
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-2897
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

NVD: CVE-2015-2897
severity: HIGH
baseScore: 10.0
vectorString: NONE
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-80858
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#628568 // VULHUB: VHN-80858 // JVNDB: JVNDB-2015-004031 // CNNVD: CNNVD-201508-047 // NVD: CVE-2015-2897

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

problemtype:CWE-Other

Trust: 0.8

sources: VULHUB: VHN-80858 // JVNDB: JVNDB-2015-004031 // NVD: CVE-2015-2897

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201508-047

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201508-047

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-004031

EXPLOIT AVAILABILITY
sources:
            
            
            CERT/CC: VU#628568

PATCH
title:ALEOS Application Frameworkurl:http://source.sierrawireless.com/resources/airlink/aleos_af/aleos_af_home/
Trust: 0.8
title:ALEOS 4.4.2 Release Notesurl:http://source.sierrawireless.com/resources/airlink/software_reference_docs/release-notes/aleos-4,-d-,4,-d-,2-release-notes/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-004031

EXTERNAL IDS
db:NVDid:CVE-2015-2897
Trust: 3.6
db:CERT/CCid:VU#628568
Trust: 3.6
db:JVNid:JVNVU95544994
Trust: 0.8
db:JVNDBid:JVNDB-2015-004031
Trust: 0.8
db:CNNVDid:CNNVD-201508-047
Trust: 0.7
db:BIDid:76264
Trust: 0.4
db:VULHUBid:VHN-80858
Trust: 0.1
sources:
            
            
            CERT/CC: VU#628568 // 
            
            
            
            VULHUB: VHN-80858 // 
            
            
            
            BID: 76264 // 
            
            
            
            JVNDB: JVNDB-2015-004031 // 
            
            
            
            CNNVD: CNNVD-201508-047 // 
            
            
            
            NVD: CVE-2015-2897

REFERENCES
url:http://www.kb.cert.org/vuls/id/628568
Trust: 2.8
url:http://source.sierrawireless.com/resources/airlink/software_reference_docs/release-notes/aleos-4,-d-,4,-d-,2-release-notes/
Trust: 1.1
url:http://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2015-2897/
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/259.html
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2897
Trust: 0.8
url:http://jvn.jp/cert/jvnvu95544994
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2897
Trust: 0.8
url:http://source.sierrawireless.com/resources/airlink/aleos_af/aleos_af_home/
Trust: 0.3
url:http://www.sierrawireless.com/
Trust: 0.3
sources:
            
            
            CERT/CC: VU#628568 // 
            
            
            
            VULHUB: VHN-80858 // 
            
            
            
            BID: 76264 // 
            
            
            
            JVNDB: JVNDB-2015-004031 // 
            
            
            
            CNNVD: CNNVD-201508-047 // 
            
            
            
            NVD: CVE-2015-2897

CREDITS
anonymous
Trust: 0.3
sources:
            
            
            BID: 76264

SOURCES
db:CERT/CCid:VU#628568
db:VULHUBid:VHN-80858
db:BIDid:76264
db:JVNDBid:JVNDB-2015-004031
db:CNNVDid:CNNVD-201508-047
db:NVDid:CVE-2015-2897

LAST UPDATE DATE
2024-11-23T22:08:00.851000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#628568date:2015-08-10T00:00:00
db:VULHUBid:VHN-80858date:2015-08-11T00:00:00
db:BIDid:76264date:2015-08-07T00:00:00
db:JVNDBid:JVNDB-2015-004031date:2015-08-17T00:00:00
db:CNNVDid:CNNVD-201508-047date:2015-08-13T00:00:00
db:NVDid:CVE-2015-2897date:2024-11-21T02:28:16.960

SOURCES RELEASE DATE
db:CERT/CCid:VU#628568date:2015-08-07T00:00:00
db:VULHUBid:VHN-80858date:2015-08-08T00:00:00
db:BIDid:76264date:2015-08-07T00:00:00
db:JVNDBid:JVNDB-2015-004031date:2015-08-11T00:00:00
db:CNNVDid:CNNVD-201508-047date:2015-08-10T00:00:00
db:NVDid:CVE-2015-2897date:2015-08-08T01:59:00.113