CVE-2023-31279 - CVE House
Back to Database
Status published High CVE-2023-31279

Improper Authentication

Vulnerability Description

The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform when the owner has not disabled the AirVantage Management Service on the devices or registered the device. This could enable an attacker to configure, manage, and execute AT commands on an unsuspecting user’s devices.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-31279

Credits & Attribution

No credits recorded in the NVD database.

References

More from Sierra Wireless

View All →
CVE-2023-31280
Exposure of Sensitive Information to an Unauthorized Actor
Medium 5.3
CVE-2020-13712
MGOS Command Injection
Unknown 0

Affected Vendor

Sierra Wireless

View all reports →

Affected Software

AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices.
Vulnerable Versions:
Devices not registered in AirVantage with the AirVantage Management Service enabled.

Timeline

Official Publish: December 20th, 2024
Last Modified: December 24th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access