CISA Adds Actively Exploited Sierra Wireless Router Flaw Enabling RCE Attacks

According to CISA, the agency on Friday added a high-severity flaw affecting Sierra Wireless AirLink ALEOS routers to its Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild. The vulnerability, CVE-2018-4063 (CVSS score: 8.8/9.9), is an unrestricted file upload flaw that could enable remote code execution via a malicious HTTP request.

Cisco Talos publicly detailed the flaw in April 2019, describing how the ACEManager “upload.cgi” function in AirLink ES450 firmware version 4.9.3 could be abused to upload and execute code, with ACEManager running as root, so uploaded payloads would gain elevated privileges. The KEV addition follows a honeypot analysis by Forescout over 90 days showing industrial routers are heavily targeted in OT environments, with attackers deploying botnets and cryptocurrency miners.

Agencies under Federal Civilian Executive Branch are advised to update to a supported version or discontinue the product by 2 January 2026 due to end-of-support status.