CVE-2020-8782 ALEOS LAN-Side RPC Service Remote Code Execution

What is CVE-2020-8782?

CVE-2020-8782 is a high-severity code injection vulnerability in n/a, published on 6 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.

Which versions are affected by CVE-2020-8782?

It affects 1 product.

Products include Sierrawireless Aleos.

How do I fix CVE-2020-8782?

No fix has been published for CVE-2020-8782 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2020-8782 being exploited?

There is no known exploitation of CVE-2020-8782 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-4063 Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Exploited High 8.8
• CVE-2015-2897 Hardcoded credentials in n/a Critical 10.0
• CVE-2019-11851 Memory corruption in n/a Critical 9.8
• CVE-2018-10251 Missing authorization in n/a Critical 9.8
• CVE-2019-11857 ALEOS AceManager Information Disclosure Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3p5q-8m4h-wr8g.