Sierra Wireless AirLink Raven ICSA-17-115-02 Multiple Security Vulnerabilities

Bugtraq ID:	98036
Class:	Input Validation Error
CVE:	CVE-2017-6044 CVE-2017-6042 CVE-2017-6046
Remote:	Yes
Local:	No
Published:	Apr 25 2017 12:00AM
Updated:	May 02 2017 01:09AM
Credit:	Karn Ganeshen.
Vulnerable:	Sierra Wireless AirLink Raven XT 0 Sierra Wireless AirLink Raven XE 0
Not Vulnerable:	Sierra Wireless AirLink Raven XT 4.0.11 Sierra Wireless AirLink Raven XE 4.0.14

Sierra Wireless AirLink Raven ICSA-17-115-02 Multiple Security Vulnerabilities

Sierra Wireless AirLink Raven is prone to a cross-site request-forgery vulnerability and multiple information-disclosure vulnerabilities.

A successful exploit may allow an attacker to obtain sensitive information, and perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

The following product versions are affected :

AirLink Raven XE, all versions prior to 4.0.14
AirLink Raven XT, all versions prior to 4.0.11

Sierra Wireless AirLink Raven ICSA-17-115-02 Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sierra Wireless AirLink Raven ICSA-17-115-02 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Sierra Wireless AirLink Raven ICSA-17-115-02 Multiple Security Vulnerabilities

References:

• Siemens Homepage (Siemens)
  
• ICSA-17-115-02:Sierra Wireless AirLink Raven XE and XT (CERT)