Sierra:21 – Flaws in Sierra Wireless Routers Expose Critical Sectors to Cyber Attacks

A collection of 21 security flaws have been found out in Sierra Wireless AirLink mobile routers and open up-resource program factors like TinyXML and OpenNDS.

Collectively tracked as Sierra:21, the issues expose about 86,000 equipment throughout critical sectors like power, healthcare, waste administration, retail, unexpected emergency services, and vehicle tracking to cyber threats, according to Forescout Vedere Labs. A bulk of these devices are located in the U.S., Canada, Australia, France, and Thailand.

“These vulnerabilities might make it possible for attackers to steal credentials, acquire manage of a router by injecting malicious code, persist on the unit and use it as an initial obtain level into critical networks,” the industrial cybersecurity organization reported in a new examination.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Forthcoming WEBINAR Cracking the Code: Learn How Cyber Attackers Exploit Human Psychology

Ever questioned why social engineering is so powerful? Dive deep into the psychology of cyber attackers in our future webinar.

Be part of Now

Of the 21 vulnerabilities, a single is rated critical, nine are rated superior, and 11 are rated medium in severity.

This includes distant code execution (RCE), cross-web page scripting (XSS), denial-of-service (DoS), unauthorized accessibility, and authentication bypasses that could be exploited to seize manage of vulnerable equipment, carry out credential theft via injection of malicious JavaScript, crash the management application, amd conduct adversary-in-the-middle (AitM) attacks.

These shortcomings can also be weaponized by botnet malware for worm-like computerized propagation, conversation with command-and-regulate (C2) servers, and enslaving afflicted prone machines to launch DDoS attacks.

Fixes for the flaws have been launched in ALEOS 4.17. (or ALEOS 4.9.9), and OpenNDS 10.1.3. TinyXML, on the other hand, is no lengthier actively taken care of, necessitating that the difficulties be tackled downstream by impacted vendors.

“Attackers could leverage some of the new vulnerabilities to just take complete handle of an OT/IoT router in critical infrastructure and achieve unique ambitions these kinds of as network disruption, espionage, lateral motion and even further malware deployment,” Forescout claimed.

“Vulnerabilities impacting critical infrastructure are like an open window for lousy actors in every neighborhood. State-sponsored actors are establishing customized malware to use routers for persistence and espionage. Cybercriminals are also leveraging routers and similar infrastructure for residential proxies and to recruit into botnets.”

Identified this posting intriguing? Follow us on Twitter  and LinkedIn to study more unique information we article.