CVE-2019-11856

A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials.

CVSS v3 3.8 LOW
CVSS v2.0 5.5 MEDIUM

3.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:P

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:sierrawireless:airlink_lx40:-:::::::*
	cpe:2.3:h:sierrawireless:airlink_lx60:-:::::::*
	cpe:2.3:h:sierrawireless:airlink_mp70:-:::::::*
	cpe:2.3:h:sierrawireless:airlink_mp70e:-:::::::*
	cpe:2.3:h:sierrawireless:airlink_rv50:-:::::::*
	cpe:2.3:h:sierrawireless:airlink_rv50x:-:::::::*

Configuration 2 (hide)

AND

cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:sierrawireless:airlink_es450:-:::::::*
	cpe:2.3:h:sierrawireless:airlink_gx450:-:::::::*

Configuration 3 (hide)

AND

cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:sierrawireless:airlink_es440:-:::::::*
	cpe:2.3:h:sierrawireless:airlink_gx400:-:::::::*
	cpe:2.3:h:sierrawireless:airlink_gx440:-:::::::*
	cpe:2.3:h:sierrawireless:airlink_ls300:-:::::::*

History

No history.

Information

Published : 2020-08-21 19:15

Updated : 2024-02-28 17:47

NVD link : CVE-2019-11856

Mitre link : CVE-2019-11856

CVE.ORG link : CVE-2019-11856

JSON object : View

Products Affected

sierrawireless

airlink_mp70
airlink_es440
airlink_gx400
airlink_mp70e
airlink_lx40
airlink_rv50
airlink_gx440
airlink_ls300
airlink_es450
airlink_gx450
airlink_rv50x
airlink_lx60
aleos

CWE

CWE-294

Authentication Bypass by Capture-replay

{"id": "CVE-2019-11856", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 0.7}]}, "published": "2020-08-21T19:15:11.700", "references": [{"url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-294"}]}], "descriptions": [{"lang": "en", "value": "A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de reutilizaci\u00f3n del nonce en el servicio ACEView de ALEOS versiones anteriores a 4.13.0, 4.9.5 y 4.4.9, permitiendo la reproducci\u00f3n de mensajes. El tr\u00e1fico capturado en el servicio ACEView puede ser reproducido en otras puertas de enlace que comparten las mismas credenciales."}], "lastModified": "2022-02-09T19:28:23.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B27D45F9-CCAD-4AF0-A71B-80024487F723", "versionEndIncluding": "4.12.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sierrawireless:airlink_lx40:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C4CEDB07-37C9-444F-9670-1807E7C3E734"}, {"criteria": "cpe:2.3:h:sierrawireless:airlink_lx60:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "631F6248-DA94-4BF8-9F78-3636CBD67F2E"}, {"criteria": "cpe:2.3:h:sierrawireless:airlink_mp70:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3D40D05C-2C06-40D7-A060-AB695909E559"}, {"criteria": "cpe:2.3:h:sierrawireless:airlink_mp70e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AD91027A-EFC8-4A29-B880-CE39D00DF86F"}, {"criteria": "cpe:2.3:h:sierrawireless:airlink_rv50:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "282D04AE-5657-42C6-9EF1-89FA8388D746"}, {"criteria": "cpe:2.3:h:sierrawireless:airlink_rv50x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AA1C2197-E412-4FE2-8DE8-3048A3727A58"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58D50C5D-E9ED-487D-A2F5-BF3381E8176B", "versionEndIncluding": "4.9.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sierrawireless:airlink_es450:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3E042BE5-9B2E-42B9-B455-FDB35251B0A6"}, {"criteria": "cpe:2.3:h:sierrawireless:airlink_gx450:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F20FC147-11AF-4E39-978A-0BC270B3CF01"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD0A0C54-3887-47DE-AD40-C7F9601024F4", "versionEndIncluding": "4.4.8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sierrawireless:airlink_es440:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A539809A-2F36-49E5-B6E1-7D13057CB5CC"}, {"criteria": "cpe:2.3:h:sierrawireless:airlink_gx400:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3ED4507B-D487-40BB-8F0C-DDE252844BF7"}, {"criteria": "cpe:2.3:h:sierrawireless:airlink_gx440:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2F6861FB-F310-4B6D-BEDD-0B1611E5CE2D"}, {"criteria": "cpe:2.3:h:sierrawireless:airlink_ls300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "06302D92-3C19-414A-B976-779FE9B01915"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}