Skip to content
CVE Tracker
Back

CVE-2018-4065

An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450…

Medium6.1EPSS 4.9%
Published
Updated
Reserved
Assigned by
talos

Description

An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP ping request can cause reflected javascript code execution, resulting in the execution of javascript code running on the victim's browser. An attacker can get a victim to click a link, or embedded URL, that redirects to the reflected cross-site scripting vulnerability to trigger this vulnerability.

Scores

CVSS scores of CVE-2018-4065, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0Medium6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS (exploitation in 30 days)
4.9% · top 8.0% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

Affected products

  • Sierra Wireless

    • affected Sierra Wireless AirLink ES450 FW 4.9.3

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .