CVE-2023-40459
published 2023-12-04CVE-2023-40459: The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.30%
81.1th percentile
The
ACEManager component of ALEOS 4.16 and earlier does not adequately perform
input sanitization during authentication, which could potentially result in a
Denial of Service (DoS) condition for ACEManager without impairing other router
functions. ACEManager recovers from the DoS condition by restarting within ten
seconds of becoming unavailable.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sierrawireless | aleos | <= 4.16.0 | — |
| sierrawireless | aleos | 4.10 – 4.16 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Sierra Wireless AirLink with ALEOS firmware
cisa_ics·2023-12-07·CVSS 7.5
[HIGH] Sierra Wireless AirLink with ALEOS firmware
ICS Advisory
##
Sierra Wireless AirLink with ALEOS firmware
Release DateDecember 07, 2023
Alert CodeICSA-23-341-06
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Sierra Wireless
- Equipment: AirLink
- Vulnerabilities: Infinite Loop, NULL Pointer Dereference, Cross-site Scripting, Reachable Assertion, Use of Hard-coded Credentials, Use of Hard-coded Cryptographic Key
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to perform remote code execution to take full control of the device, steal credentials through a cross site scripting attack, or crash the device being accessed through a denial-of-service attack.
## 3. TECHNICAL DETAILS
## 3.1 AFFEC
GHSA
GHSA-mrh4-hf55-27fq: The
ACEManager component of ALEOS 4
ghsa_unreviewed·2023-12-05
CVE-2023-40459 [HIGH] CWE-476 GHSA-mrh4-hf55-27fq: The
ACEManager component of ALEOS 4
The
ACEManager component of ALEOS 4.16 and earlier does not adequately perform
input sanitization during authentication, which could potentially result in a
Denial of Service (DoS) condition for ACEManager without impairing other router
functions. ACEManager recovers from the DoS condition by restarting within ten
seconds of becoming unavailable.
No detection rules found.
No public exploits indexed.
2023-12-04
Published