The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary code via a buffer overflow.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSierrawireless Aleos
OSSierrawireless4.10.0 – 4.14.0 (excl.)4.5.0 – 4.9.5 (excl.)< 4.4.9Sierrawireless Es440
HWSierrawirelessall versionsSierrawireless Es450
HWSierrawirelessall versionsSierrawireless Gx400
HWSierrawirelessall versionsSierrawireless Gx440
HWSierrawirelessall versionsSierrawireless Gx450
HWSierrawirelessall versionsSierrawireless Ls300
HWSierrawirelessall versionsSierrawireless Lx40
HWSierrawirelessall versionsSierrawireless Lx60
HWSierrawirelessall versionsSierrawireless Mp70
HWSierrawirelessall versionsSierrawireless Mp70e
HWSierrawirelessall versionsSierrawireless Rv50
HWSierrawirelessall versionsSierrawireless Rv50x
HWSierrawirelessall versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEMemory
Related vulnerabilities
CVE-2019-11857CRITICAL9.1PL ✓same product
Brak sanityzacji danych wejściowych w AceManager — Sierra Wireless ALEOS
CVE-2018-10251CRITICAL9.8PL ✓same product
RCE w routerach Sierra Wireless AirLink — wykonanie kodu z uprawnieniami root
CVE-2018-4063HIGH8.8⚠ KEVsame product
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless A...
CVE-2023-38321HIGH7.5same product
OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to caus...
CVE-2023-40459HIGH7.5same product
The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization dur...