The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2018-4063, a vulnerability affecting Sierra Wireless AirLink routers running ALEOS, to its Known Exploited Vulnerabilities catalog on December 12, 2025, citing evidence of active exploitation. Federal Civilian Executive Branch agencies face a January 2, 2026 remediation deadline, according to The Hacker News.
The flaw allows an authenticated attacker to upload executable code through ACEManager, the routers’ web management interface. Cisco Talos publicly disclosed the vulnerability on April 25, 2019, after reporting it to Sierra Wireless in December 2018.
Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate cataloged vulnerabilities by their assigned deadlines. CISA also urges other organizations to prioritize these vulnerabilities, although the directive does not apply to them.
Authenticated upload enables code execution
Talos tested the vulnerability in AirLink ES450 firmware version 4.9.3. Its report describes an unrestricted file upload flaw in the /cgi-bin/upload.cgi endpoint used to upload templates.
According to Talos, the upload function allows an attacker to overwrite existing files and inherit their permissions. Replacing a file that already has executable permissions allows uploaded code to run through the web server. Because ACEManager runs as root, code executed this way also runs with root privileges.
Exploitation requires an authenticated HTTP request. Talos also recorded the vendor’s statement that ACEManager is not accessible from the cellular wide-area network by default.
Published severity ratings differ: Talos assigns a CVSS v3 score of 9.9, while CISA’s technical advisory lists 9.1. The Hacker News reports ratings of 8.8 and 9.9.
Affected firmware and vendor guidance
Sierra Wireless’ security bulletin covering this and related Talos vulnerabilities identifies the following affected products and ALEOS versions:
- LS300, GX400, GX440 and ES440 running version 4.4.8 or earlier.
- GX450 and ES450 running versions before 4.9.4.
- MP70, MP70E, RV50, RV50X, LX40 and LX60 running versions before 4.12.
CISA’s technical advisory provides vendor upgrade guidance and recommends minimizing internet exposure, placing control-system networks and remote devices behind firewalls, and using secure remote access. Sierra Wireless also recommends strong passwords for management and other enabled accounts.
Semtech completed its acquisition of Sierra Wireless on January 12, 2023.
Forescout documents exploitation and broader scanning
Forescout Research – Vedere Labs described an activity cluster it named Chaya_005 in its report examining 90 days of honeypot traffic. Researchers traced the cluster’s earlier activity to successful exploitation of a Sierra Wireless router, followed by malformed exploit attempts against other edge devices. The Hacker News, reporting on Forescout’s findings, said the cluster exploited CVE-2018-4063 in early January 2024.
Forescout said it had not observed successful exploitation after the cluster’s initial activity and did not consider Chaya_005 a significant threat at the time of its report. CISA’s December 12 announcement did not identify an attacker or connect its catalog decision to that cluster.
The same Forescout report found that, after excluding SNMP traffic and focusing on operational technology assets, perimeter devices received 67% of requests, while exposed OT devices received 33%. The perimeter group contained three industrial wireless routers and an industrial firewall; the exposed OT group contained three programmable logic controllers and a web server hosting a human-machine interface.
The firewall remained the most targeted individual device across the honeypot environment after SNMP traffic was removed. The findings describe activity in that environment, rather than attack rates across industrial networks generally.
SSH and Telnet accounted for 72% of perimeter-device requests, predominantly authentication brute-force attempts. HTTP and HTTPS accounted for 24%, including exploit attempts and malware-download activity.
Forescout mapped almost 3,000 HTTP/HTTPS requests to attempted vulnerability exploitation and identified activity associated with RondoDox, Redtail and ShadowV2. Most of those exploit requests did not match the devices or software versions in the honeypot environment. The malware observations do not establish that those families exploited CVE-2018-4063.