PT-2023-7521 · Sierra Wireless · Aleos

Name of the Vulnerable Software and Affected Versions: ALEOS versions 4.16 and earlier Description: The issue is related to the use of hardcoded credentials in the debugging mode of the ALEOS operating system for Sierra Wireless MP70, RV50x, RV55, LX40, LX60 ES450, GX450 wireless routers. When...

The vulnerability of the iplogging.cgi executable file of the ALEOS software for Sierra Wireless routers allows a hacker to execute arbitrary code.

The vulnerability of the iplogging.cgi executable file of the ALEOS router software developed by Sierra Wireless exists because measures to neutralize the special elements used in the operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2022-46649

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device...

CVE-2022-46649

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device...

CVE-2022-46650

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...

CVE-2022-46650

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...

Command injection

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device...

Code injection

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...

CVE-2022-46649: Improper Neutralization of Special Elements used in an OS Command

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device...

CVE-2022-46650: Exposure of Sensitive Information to an Unauthorized Actor

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...

CVE-2022-46650

CVE-2022-46650 affects ALEOS’ Acemanager prior to 4.16. Authenticated users can reconfigure the device to expose ACEManager credentials on the pre-login status page (root cause: credential disclosure on login-page flow). Public references confirm a CVSS v3.1 base score of 4.9 (Medium) with networ...

CVE-2022-46649

CVE-2022-46649 affects Acemanager in ALEOS prior to 4.16. An authenticated user can manipulate the IP logging operation to execute arbitrary shell commands on the device. Public material (e.g., Red Hat, NVD, Trellix blogs) confirms an authenticated command-injection vector with CVSS v3.1 base sco...

CVE-2022-46650

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...

PT-2023-14980 · Aleos · Aleos

Name of the Vulnerable Software and Affected Versions: ALEOS versions prior to 4.16 Description: The issue allows a user with valid credentials to reconfigure the device, exposing the ACEManager credentials on the pre-login status page. Recommendations: For versions prior to 4.16, update to versi...

PT-2023-1889

Name of the Vulnerable Software and Affected Versions ALEOS versions prior to 4.16 Description The issue allows a user with valid credentials to manipulate the IP logging operation, potentially leading to the execution of arbitrary shell commands on the device. This is due to the lack of measures...

CVE-2022-46650

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...

CVE-2022-46649

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device...

Sierra Wireless AirLink Router with ALEOS Software

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sierra Wireless Equipment: AirLink Router with ALEOS Software Vulnerabilities: Improper Neutralization of Argument Delimiters in a Command, Exposure of Sensitive Information to an Unauthorized Actor 2...

CVE-2019-11851

The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary code via a buffer overflow...

CVE-2019-11851

The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary code via a buffer overflow...