CVE-2019-11848

ALEOS AT Command API Abuse

HIGH

7.2

CVSS Score

Published: August 21, 2020 at 06:44 PM UTC

Updated: June 17, 2026 at 02:13 AM UTC

13 products affected across 1 vendorALEOSAirlink Es450Airlink Rv50

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.2

Exploit prediction

EPSS 1%

Description

An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ALEOS · Sierrawireless

95%

v < 4.13.0v < 4.4.9v < 4.9.5

Affected range stops below 4.13.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.9.5, so it looks safe — our inference, not a vendor statement

sierrawireless-airlink-es440 (environment) · sierrawireless-airlink-es450 (environment) · sierrawireless-airlink-gx400 (environment) · sierrawireless-airlink-gx440 (environment) · sierrawireless-airlink-gx450 (environment) · sierrawireless-airlink-ls300 (environment) · sierrawireless-airlink-lx40 (environment) · sierrawireless-airlink-lx60 (environment) · sierrawireless-airlink-mp70 (environment) · sierrawireless-airlink-mp70e (environment) · sierrawireless-airlink-rv50 (environment) · sierrawireless-airlink-rv50x (environment)

Airlink Es440 · Sierrawirelessdevice

80%

All versions

Airlink Es450 · Sierrawirelessdevice

80%

All versions

Airlink Gx400 · Sierrawirelessdevice

80%

All versions

Airlink Gx440 · Sierrawirelessdevice

80%

All versions