« Volver al listado

CVE-2015-2054

Estado: ModificadaMedia (4.3)—

CRLF injection vulnerability in export.cfg in the web-based administrative console for Sierra Wireless AirCard 760S, 762S, and 763S allows remote attackers to inject arbitrary headers via CRLF sequences in the save parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Sierra Wireless — Sierra Wireless Aircard 760sSierra Wireless — Sierra Wireless Aircard 762sSierra Wireless — Sierra Wireless Aircard 763s

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-2054",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-02-23T17:59:11.150",
  "references": [
    {
      "url": "http://seclists.org/fulldisclosure/2015/Jan/58",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/74875",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2015/Jan/58",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/74875",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CRLF injection vulnerability in export.cfg in the web-based administrative console for Sierra Wireless AirCard 760S, 762S, and 763S allows remote attackers to inject arbitrary headers via CRLF sequences in the save parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección CRLF en export.cfg en la consola basada en web para Sierra Wireless AirCard 760S, 762S, y 763S permite a atacantes remotos inyectar cabeceras arbitrarias a través de secuencias de CRLF en el parámetro save."
    }
  ],
  "lastModified": "2026-06-17T00:23:31.053",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sierra_wireless:sierra_wireless_aircard_760s:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A4481C1-EC90-4E91-9809-70DEDE23BC80"
            },
            {
              "criteria": "cpe:2.3:h:sierra_wireless:sierra_wireless_aircard_762s:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28C241C6-065F-40A6-AE60-A656AA86A382"
            },
            {
              "criteria": "cpe:2.3:h:sierra_wireless:sierra_wireless_aircard_763s:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "783AFBE2-E65E-4ABB-B91A-2747E1FBF058"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/93.html\" target=\"_blank\">CWE-93: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a>",
  "sourceIdentifier": "cve@mitre.org"
}