CVE-2016-5065

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Apr 10, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-50669.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.CVE-2016-50678.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection.CVE-2016-50689.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.CVE-2016-50699.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.CVE-2016-50709.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext.CVE-2016-50718.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root.CVE-2016-50728.8OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versionsCVE-2016-50736.1CloudView NMS before 2.10a has XSS via SNMP.CVE-2016-50749.8CloudView NMS before 2.10a has a format string issue exploitable over SNMP.CVE-2016-50756.1CloudView NMS before 2.10a has XSS via a TELNET login.CVE-2016-50767.5CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def.CVE-2016-50776.1Netikus EventSentry before 3.2.1.44 has XSS via SNMP.