CVE-2018-10251

CRITICAL

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges.

Published: May 4, 2018 Modified: Jun 17, 2026

CWE-862 CWE-1188

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (2)

Vendor	Product	Version
sierrawireless	aleos	* < 4.4.7
sierrawireless	aleos	* < 4.9.3

GitHub Security Advisory GHSA-fwv8-jff3-8mm6

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware...

References (2)

https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251/ Mitigation, Vendor Advisory
https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---cve-2018-10251/ Mitigation, Vendor Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 4.49%

Top 9% most likely to be exploited

Threat Score 40.5 / 100

Data Sources

NVD EPSS GitHub