CVE-2018-4063

Unrestricted Upload of File with Dangerous Type in Sierra Wireless AirLink ALEOS. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 12 December 2025.

Product: Sierra Wireless AirLink ALEOS
Added to CISA's catalog: 12 December 2025
Federal fix-by date: 2 January 2026
Ransomware: No known use in ransomware campaigns
Vendor advisories: source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2019-003
source.sierrawireless.com/resources/airlink/hardware_reference_docs/airlink_es450_eol
Sources: CISA’s catalog, NVD entry

CISA’s description.

Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 3 November 2026.