CVE-2023-40464

2023-12-0423:15:26

CWE-798

CWE-321

[email protected]

web.nvd.nist.gov

cve-2023-40464

aleos

man in the middle attack

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

17.6%

JSON

Several versions of
ALEOS, including ALEOS 4.16.0, use a hardcoded

SSL certificate and
private key. An attacker with access to these items

could potentially
perform a man in the middle attack between the

ACEManager client
and ACEManager server.

Affected configurations

Nvd

Node

sierrawirelessaleosRange≤4.16.0

AND

sierrawirelesses450Match-

sierrawirelessgx450Match-

sierrawirelesslx40Match-

sierrawirelesslx60Match-

sierrawirelessmp70Match-

sierrawirelessrv50xMatch-

sierrawirelessrv55Match-

VendorProductVersionCPE
sierrawirelessaleos*cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*
sierrawirelesses450-cpe:2.3:h:sierrawireless:es450:-:*:*:*:*:*:*:*
sierrawirelessgx450-cpe:2.3:h:sierrawireless:gx450:-:*:*:*:*:*:*:*
sierrawirelesslx40-cpe:2.3:h:sierrawireless:lx40:-:*:*:*:*:*:*:*
sierrawirelesslx60-cpe:2.3:h:sierrawireless:lx60:-:*:*:*:*:*:*:*
sierrawirelessmp70-cpe:2.3:h:sierrawireless:mp70:-:*:*:*:*:*:*:*
sierrawirelessrv50x-cpe:2.3:h:sierrawireless:rv50x:-:*:*:*:*:*:*:*
sierrawirelessrv55-cpe:2.3:h:sierrawireless:rv55:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sierrawireless	aleos	*	cpe:2.3:o:sierrawireless:aleos::::::::
sierrawireless	es450	-	cpe:2.3:h:sierrawireless:es450:-:::::::*
sierrawireless	gx450	-	cpe:2.3:h:sierrawireless:gx450:-:::::::*
sierrawireless	lx40	-	cpe:2.3:h:sierrawireless:lx40:-:::::::*
sierrawireless	lx60	-	cpe:2.3:h:sierrawireless:lx60:-:::::::*
sierrawireless	mp70	-	cpe:2.3:h:sierrawireless:mp70:-:::::::*
sierrawireless	rv50x	-	cpe:2.3:h:sierrawireless:rv50x:-:::::::*
sierrawireless	rv55	-	cpe:2.3:h:sierrawireless:rv55:-:::::::*