HIGH🇵🇱 Wersja polska

CVE-2023-40459

CVSS 7.5v3.1pub. 2023-12-04upd. 2024-11-21

The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting within ten seconds of becoming unavailable.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  • Sierrawireless Aleos

    OS
    Sierrawireless
    ≤ 4.16.0

  • Sierrawireless Es450

    HW
    Sierrawireless
    all versions

  • Sierrawireless Gx450

    HW
    Sierrawireless
    all versions

  • Sierrawireless Lx40

    HW
    Sierrawireless
    all versions

  • Sierrawireless Lx60

    HW
    Sierrawireless
    all versions

  • Sierrawireless Mp70

    HW
    Sierrawireless
    all versions

  • Sierrawireless Rv50x

    HW
    Sierrawireless
    all versions

  • Sierrawireless Rv55

    HW
    Sierrawireless
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
DoS
CWE
References

Related vulnerabilities

CVE-2019-11851CRITICAL9.8PL ✓same product

Buffer overflow w usłudze ACENet Sierra Wireless ALEOS umożliwia RCE

CVE-2019-11857CRITICAL9.1PL ✓same product

Brak sanityzacji danych wejściowych w AceManager — Sierra Wireless ALEOS

CVE-2018-10251CRITICAL9.8PL ✓same product

RCE w routerach Sierra Wireless AirLink — wykonanie kodu z uprawnieniami root

CVE-2018-4063HIGH8.8⚠ KEVsame product

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless A...

CVE-2023-38321HIGH7.5same product

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to caus...