Home / Items
VulnerabilityKnown exploitedExploit likelihood 27%
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2018-4063 · CISA KEV · December 12, 2025
Summary
Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
From CISA, quoted as published. Check the source before acting.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA required action, quoted.
Affected products
| Vendor | Product |
|---|---|
| Sierra Wireless | AirLink ALEOS |
Why it's on these mode pages
- Maritime: Vendor table: Sierra Wireless (network and remote-access gear used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Sierra Wireless (network and remote-access gear used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Sierra Wireless (network and remote-access gear used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Sierra Wireless (network and remote-access gear used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Sierra Wireless (network and remote-access gear used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Sierra Wireless (network and remote-access gear used in every mode, all modes) (matched by rule)
Change history
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com