CVE-2018-4063

What is Sierra Wireless AirLink ALEOS?

Sierra Wireless AirLink devices are industrial cellular gateways and routers deployed to provide wireless connectivity for critical infrastructure, industrial control systems, retail point-of-sale networks, fleet/vehicle telematics, and remote monitoring equipment. ALEOS is the embedded firmware that runs on these gateways, providing the web-based management console administrators use to configure and monitor the device. Because AirLink gateways often sit at the network edge connecting field equipment back to core infrastructure, compromising one can give an attacker a foothold directly into operational technology (OT) or industrial environments.

Overview

CVE-2018-4063 is an unrestricted file upload vulnerability in the ALEOS web management interface. An authenticated attacker can send a specially crafted HTTP request to upload a file to the device — and because the upload path does not adequately restrict file type, the uploaded content can include executable code that becomes routable and executable through the device's webserver, giving the attacker a path to running arbitrary code on the gateway.

Technical Details

The flaw is classified under CWE-434 (unrestricted upload of file with dangerous type): the ALEOS web interface accepts file uploads without sufficiently validating or restricting the type of content being uploaded, and does not isolate uploaded files from locations the webserver will serve and execute. An attacker holding valid low-privileged credentials to the web console can exploit this to place an executable payload where the webserver will run it, achieving code execution on the gateway itself.

Discovery

This vulnerability was coordinated through CISA's ICS advisory process (ICSA-19-122-03) and addressed by Sierra Wireless via technical bulletin SWI-PSA-2019-003. Given the affected AirLink models are noted as potentially end-of-life or end-of-service, Sierra Wireless's guidance for older, unsupported hardware is discontinuation rather than a firmware patch.

Exploitation Context

CISA's KEV catalog addition in December 2025 — more than six years after the original 2019 disclosure — indicates this vulnerability has been observed under active exploitation in the wild, likely against long-lived, unpatched, or end-of-life AirLink gateways still deployed in industrial and critical infrastructure settings. Devices of this type are frequently left in place for years past their supported lifecycle because replacing embedded field hardware is costly and operationally disruptive, which is precisely the exposure window attackers are now taking advantage of.

Remediation

1. Identify all Sierra Wireless AirLink devices running ALEOS firmware in your environment and check their support status against Sierra Wireless's end-of-life/end-of-service notices.
2. Apply the firmware update and mitigations described in Sierra Wireless technical bulletin SWI-PSA-2019-003 for any device that remains within its supported lifecycle.
3. Discontinue and replace any AirLink units confirmed to be end-of-life or end-of-service, since no further security patches will be issued for them.
4. Restrict access to the ALEOS web management interface to trusted management networks only, and disable remote/internet-facing administrative access wherever possible.
5. Audit device configurations and uploaded file directories for signs of unauthorized files or webshell-style payloads consistent with this vulnerability's exploitation.