Information disclosure in Sierra Wireless products - CVE-2022-46650

Vulnerability identifier: #VU71594

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-46650

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote administrator can reconfigure the device to expose the ACEManager credentials on the pre-login status page.

Airlink Router ES450
Airlink Router GX450
Airlink Router MP70
Airlink Router RV50
Airlink Router RV50x
Airlink Router RV55
Airlink Router LX 40
Airlink Router LX60

Install updates from vendor's website.

Airlink Router ES450 - update to 4.9.8
Airlink Router GX450 - update to 4.9.8
Airlink Router MP70 - update to 4.16.0
Airlink Router RV50 - update to 4.16.0
Airlink Router RV50x - update to 4.16.0
Airlink Router RV55 - update to 4.16.0
Airlink Router LX 40 - update to 4.16.0
Airlink Router LX60 - update to 4.16.0

• https://ics-cert.us-cert.gov/advisories/icsa-23-026-04

• Multiple vulnerabilities in Sierra Wireless AirLink Router with ALEOS Software