182 matches found
CVE-2023-40458
Removed by vendor...
CVE-2023-40458: Loop with Unreachable Exit Condition
Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a Denial of Service DoS condition for ACEManager without impairing other router functions. This condition is cleared by restarting the device...
Sierra Wireless ALEOS Security Vulnerability
Sierra Wireless ALEOS AAF is Sierra Wireless Canada's framework for creating applications in Sierra Wireless AirLink gateways. A security vulnerability exists in Sierra Wireless ALEOS 4.16 and prior versions that stems from the presence of an infinite loop, which allows an attacker to trigger a...
PT-2023-7523 · Aleos · Aleos
Name of the Vulnerable Software and Affected Versions: ALEOS versions 4.16 and earlier Description: The issue is related to the ACEManager component of the ALEOS operating system, which does not validate uploaded file names and types. This could potentially allow an authenticated user to perform...
PT-2023-7520 · Aleos · Aleos
Name of the Vulnerable Software and Affected Versions: ALEOS versions 4.16 and earlier Description: The issue is related to the ACEManager component of the ALEOS operating system, which does not properly validate file names in a file upload field. This can lead to a Stored Cross-Site Scripting...
PT-2023-7524 · Sierra Wireless · Es450 +8
Name of the Vulnerable Software and Affected Versions: ALEOS versions 4.16 and earlier Description: The issue is related to the ACEManager component of the ALEOS operating system in Sierra Wireless wireless routers, including MP70, RV50x, RV55, LX40, LX60 ES450, and GX450. It is caused by a lack ...
CVE-2022-46649
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device...
CVE-2022-46649
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device...
CVE-2022-46650
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...
Command injection
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device...
Code injection
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...
CVE-2022-46649
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device...
CVE-2022-46649: Improper Neutralization of Special Elements used in an OS Command
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device...
CVE-2022-46650
CVE-2022-46650 affects ALEOS’ Acemanager prior to 4.16. Authenticated users can reconfigure the device to expose ACEManager credentials on the pre-login status page (root cause: credential disclosure on login-page flow). Public references confirm a CVSS v3.1 base score of 4.9 (Medium) with networ...
CVE-2022-46650: Exposure of Sensitive Information to an Unauthorized Actor
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...
CVE-2022-46649
CVE-2022-46649 affects Acemanager in ALEOS prior to 4.16. An authenticated user can manipulate the IP logging operation to execute arbitrary shell commands on the device. Public material (e.g., Red Hat, NVD, Trellix blogs) confirms an authenticated command-injection vector with CVSS v3.1 base sco...
CVE-2022-46650
Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page...
PT-2023-14980 · Aleos · Aleos
Name of the Vulnerable Software and Affected Versions: ALEOS versions prior to 4.16 Description: The issue allows a user with valid credentials to reconfigure the device, exposing the ACEManager credentials on the pre-login status page. Recommendations: For versions prior to 4.16, update to versi...
