LiveActive security incident?Get immediate response
CVE Record

CVE-2019-11855: ALEOS LAN-Side RPC Server

An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9.

HighCVSS 8.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2019-11855 concerns an RPC service enabled by default on the LAN side of ALEOS gateways. The CVSS score is high because successful network access could affect confidentiality, integrity, and availability. The source bundle does not show internet exposure or active exploitation.

Executive priority

Prioritize remediation for ALEOS gateways in sensitive, remote, industrial, or payment environments. The issue is high severity but appears LAN-side from the sources, so urgency should track internal network exposure and asset criticality.

Technical view

The CVE describes a default-enabled RPC server on the gateway LAN in ALEOS versions before 4.12.0, 4.9.5, and 4.4.9. CVSS 3.1 is 8.1 with network attack vector, high complexity, no privileges, no user interaction, and high C/I/A impact.

Likely exposure

Organizations using ALEOS gateways below the listed fixed version lines are the likely exposure group. The cited description is LAN-side, so risk depends on who can reach gateway LAN interfaces, including internal users, adjacent networks, VPN users, or compromised LAN hosts.

Exploitation context

The bundle does not include exploit details, public exploitation claims, or CISA KEV listing. Treat this as a high-impact LAN-reachable issue, but do not assume active exploitation from the provided evidence.

Researcher notes

The public source bundle is sparse: no CWE, no CPEs, no affected model list, and no exploit narrative. The main defensible facts are the default-enabled LAN RPC server, vulnerable ALEOS version thresholds, CVSS vector, and absence from KEV.

Mitigation direction

  • Upgrade ALEOS to 4.12.0, 4.9.5, 4.4.9, or later applicable vendor guidance.
  • Review the Sierra Wireless bulletin for model-specific instructions and constraints.
  • Restrict gateway LAN management reachability to trusted administrative networks only.
  • Segment untrusted users, VPN clients, and general workstations away from gateway interfaces.
  • Monitor vendor advisories for updated remediation or configuration guidance.

Validation and detection

  • Inventory ALEOS gateways and record current firmware versions.
  • Compare firmware against the vulnerable thresholds listed in the CVE description.
  • Confirm LAN-side access is limited to authorized administrative sources.
  • Check whether VPN or adjacent network paths can reach gateway LAN services.
  • Retain evidence of firmware version, segmentation, and vendor bulletin review.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-11855 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.1High
CVSS 3.1 vector shape for CVE-2019-11855Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.