CVE-2018-4063 Elastic Security · Elastic

Detect Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation in Elastic Security

Detects exploitation of CVE-2018-4063, an unrestricted file upload vulnerability (CWE-434) in Sierra Wireless AirLink ALEOS firmware. Attackers can upload files with dangerous types via the ACEmanager web interface, enabling remote code execution on cellular gateway devices. This vulnerability is listed in CISA KEV and has been exploited in the wild against critical infrastructure.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by source.ip with maxspan=5m
  [network where destination.port in (9443, 443, 80, 8080)
   and http.request.method == "POST"
   and (
     url.path like "*acemanager*" or
     url.path like "*/upload*" or
     url.path like "*/cgi-bin*" or
     url.path like "*/firmware*"
   )
  ]
  [network where destination.port in (9443, 443, 80, 8080)
   and (
     url.path like "*.php" or
     url.path like "*.asp" or
     url.path like "*.aspx" or
     url.path like "*.jsp" or
     url.path like "*.cgi" or
     url.path like "*.sh" or
     url.path like "*.elf" or
     url.path like "*.py"
   )
  ]
critical severity medium confidence

EQL sequence detecting a two-stage upload pattern: first a POST to ALEOS management endpoints, followed by a request containing a dangerous file extension — consistent with CVE-2018-4063 exploitation.

Data Sources

Network Packet LogsHTTP Access LogsElastic Agent Network Events

Required Tables

logs-network.*logs-endpoint.events.network*filebeat-*

False Positives & Tuning

  • Authorized firmware update workflows where administrators upload new ALEOS firmware images
  • Network scanners performing automated discovery against cellular gateway management ports
  • Legitimate IT automation uploading configuration scripts to ALEOS devices
  • SNMP or REST API polling tools that generate sequential management-port connections

Other platforms for CVE-2018-4063

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate File Upload to ALEOS ACEmanager Endpoint

    Expected signal: HTTP POST to port 9443 with multipart/form-data body containing a .php file extension; network flow from attacker IP to ALEOS management IP

  2. Test 2Upload ELF Binary to ALEOS CGI Directory

    Expected signal: POST request to /cgi-bin/upload with Content-Disposition header containing filename ending in .elf; successful HTTP 200 response if device is unpatched

  3. Test 3Enumerate ALEOS ACEmanager Upload Endpoints

    Expected signal: Sequential GET requests from a single source IP to multiple ALEOS management paths within a short time window; HTTP response codes indicating which paths are accessible

Last updated: 2026-06-19 Research depth: standard
References (4)

Unlock Pro Content

Get the full detection package for CVE-2018-4063 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1021Remote Services

Same Tactic: Initial Access

Popular Detections