CVE-2018-4063 is an unrestricted file-upload vulnerability in the upload.cgi component of Sierra Wireless AirLink ES450/GX450 industrial cellular gateways: an attacker who can make an authenticated HTTP request can upload a file that becomes executable and routable on the device's webserver, giving remote code execution, and the device line is now past end-of-life, which CISA's KEV entry explicitly flags.
Vulnerability summary
8.8
High
27.3%
EPSS score (FIRST)
Yes
CISA KEV catalog
2019-05-06
Published
Vulnerability ID: CVE-2018-4063 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Sierra Wireless AirLink ES450 / GX450 (ALEOS firmware) | cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* | ALEOS firmware before 4.9.4 on AirLink ES450 and GX450 hardware (per NVD CPE data); fixed in 4.9.4 or later |
What this means
CVE-2018-4063 is a classic unrestricted-upload vulnerability (CWE-434) in the upload.cgi functionality of Sierra Wireless AirLink ALEOS firmware on the ES450 and GX450 industrial cellular gateways — devices widely used to provide cellular backhaul connectivity for remote OT/ICS sites, ATMs, kiosks and vehicles. NVD's description states: "An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability" (NVD). The bug was originally discovered and reported by Cisco Talos as TALOS-2018-0748 (Talos vulnerability report TALOS-2018-0748).
NVD assigns a Primary CVSS v3.1 score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (network-reachable, low complexity, low privileges required, full confidentiality/integrity/availability impact), and a Primary CVSS v2.0 score of 9.0 (NVD). CISA's own companion ICS advisory scores the same CVE differently — CVSS v3 9.1, vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H — reflecting CISA's judgment that exploitation requires higher privileges but produces a scope change; both assessments agree the flaw is network-exploitable and high-impact, but operators should note the NVD-confirmed figure (8.8) is the one this page indexes on, per policy (CISA ICS Advisory ICSA-19-122-03).
The CISA ICS advisory (ICSA-19-122-03, part of a batch covering seven related ALEOS flaws across multiple product lines) lists CVE-2018-4063 as affecting GX450 and ES450 devices running ALEOS firmware before 4.9.4, fixed in 4.9.4 or later, and states in its executive summary that the batch is "exploitable remotely," needs only a "low skill level to exploit," and that "public exploits are available" (CISA ICS Advisory ICSA-19-122-03).
CISA added CVE-2018-4063 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-12-12, with a required-action due date of 2026-01-02; the KEV entry itself notes "the impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization" (CISA KEV), consistent with Sierra Wireless's own EoL notice for the ES450 hardware line (Sierra Wireless AirLink ES450 EoL notice).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.2726 (98.054th percentile) — a high figure for a seven-year-old CVE, reflecting continued scanning for this long-known, publicly-exploited bug (FIRST EPSS).
Because the vendor itself directs users toward discontinuation rather than ongoing patching, any ES450/GX450 unit still in service on firmware before 4.9.4 should be replaced with a currently supported AirLink model rather than left running, and should not be reachable from untrusted networks in the interim.
Evidence
- Unrestricted file upload in upload.cgi on Sierra Wireless AirLink ES450/GX450 lets an authenticated attacker upload a file that becomes executable and routable on the device webserver, achieving RCE. — NVD
- NVD Primary CVSS v3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and Primary CVSS v2.0 is 9.0; CISA's own ICS advisory scores the same CVE at CVSS v3 9.1 with a different vector (PR:H, scope changed). — NVD
- Affected: GX450 and ES450 running ALEOS firmware before 4.9.4, fixed in 4.9.4 or later; advisory batch states exploitation requires low skill and public exploits are available. — CISA ICS Advisory ICSA-19-122-03
- Added to the CISA KEV catalog on 2025-12-12, due date 2026-01-02; KEV entry notes the product could be EoL/EoS and recommends discontinuing use, matching Sierra Wireless's own ES450 end-of-life notice. — CISA KEV
- EPSS score is 0.2726 (98.054th percentile) as of 2026-10-29. — FIRST EPSS
