CVE:CVE-2017-15043
CNNVD:CNNVD-201805-165
Sierra Wireless AirLink GX400等都是加拿大Sierra Wireless公司的路由器产品。
多款Sierra Wireless产品中存在安全漏洞，该漏洞源于程序没有对HTTP请求中用户控制的输入执行充分的输入校验。攻击者可通过向受影响系统发送特制的HTTP请求利用该漏洞执行任意代码并完全控制受影响的系统（包括以root权限发布命令）。以下产品和版本受到影响：使用4.4.5之前版本固件的Sierra Wireless AirLink GX400；使用4.4.5之前版本固件的Sierra Wireless AirLink GX440；使用4.4.5之前版本固件的Sierra Wireless AirLink ES440；使用4.4.5之前版本固件的Sierra Wireless AirLink LS300；使用4.9之前版本固件的Sierra Wireless AirLink GX450；使用4.9之前版本固件的Sierra Wireless AirLink ES450；使用4.9之前版本固件的Sierra Wireless AirLink RV50；使用4.9之前版本固件的Sierra Wireless AirLink RV50X；使用4.9之前版本固件的Sierra Wireless AirLink MP70；使用4.9之前版本固件的Sierra Wireless AirLink MP70E。
solution:Upgrade sierrawireless gx440_firmware to a higher version than 4.4.5,and avoid the version (,4.4.5); Upgrade sierrawireless es440_firmware to a higher version than 4.4.5,and avoid the version (,4.4.5); Upgrade sierrawireless ls300_firmware to a higher version than 4.4.5,and avoid the version (,4.4.5); Upgrade sierrawireless gx400_firmware to a higher version than 4.4.5,and avoid the version (,4.4.5); Upgrade sierrawireless es450_firmware to a higher version than 4.9,and avoid the version (,4.9); Upgrade sierrawireless rv50_firmware to a higher version than 4.9,and avoid the version (,4.9); Upgrade sierrawireless rv50x_firmware to a higher version than 4.9,and avoid the version (,4.9); Upgrade sierrawireless mp70_firmware to a higher version than 4.9,and avoid the version (,4.9); Upgrade sierrawireless mp70e_firmware to a higher version than 4.9,and avoid the version (,4.9); Upgrade sierrawireless gx450_firmware to a higher version than 4.9,and avoid the version (,4.9)