CVE-2017-6046

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Sensitive information is insufficiently protected during transmission and vulnerable to sniffing, which could lead to information disclosure.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522 CWE-200

Affected software

Vendor	Product	Versions
n/a	Sierra Wireless AirLink Raven XE and XT	Sierra Wireless AirLink Raven XE and XT

References

http://www.securityfocus.com/bid/98036Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02Third Party Advisory, US Government Resource, VDB Entry
http://www.securityfocus.com/bid/98036Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02Third Party Advisory, US Government Resource, VDB Entry

Timeline

Published: Jun 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-60479.8Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessible without authentic CVE-2017-60488.8A Command Injection issue was discovered in Satel Iberia SenNet Data Logger and Electricity Meters: SenNet Optimal DataLogger V5.37c-1.43c a CVE-2017-60497.5Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL.CVE-2017-60509.8A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. The application fails to properly validate user inpu CVE-2017-60517.0An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search CVE-2017-60523.7A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verifie CVE-2017-60536.1A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow J CVE-2017-60547.5A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-c CVE-2017-60557.8XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read CVE-2017-60567.5It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in den CVE-2017-60587.5Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxn CVE-2017-60597.5Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote att