268 matches found
Code injection
The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying...
Design/Logic Flaw
Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...
Buffer overflow
A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root...
Design/Logic Flaw
An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values...
Default credentials
An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9...
Design/Logic Flaw
A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials...
Buffer overflow
Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...
Design/Logic Flaw
An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shell...
Cross site scripting
An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9. Sensitive information may be disclosed via the ACEviewservice, accessible by default on the LAN...
CVE-2019-11862
The CVE affects the ALEOS SSH service prior to 4.12.0, 4.9.5, and 4.4.9, where the SSH service allows traffic proxying. The provided data includes CVSSv3.1 metrics (AV:L, AC:L, PR:N, UI:N, S:U; C/H/I/H/A/H; base 8.4) and CVSSv2 metrics (base 4.6) indicating HIGH impact on confidentiality, integri...
CVE-2019-11862 ALEOS SSH Service Allows Traffic Proxying
The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying...
CVE-2019-11858 ALEOS Multiple Web UI vulnerabilities
Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...
CVE-2019-11858
CVE-2019-11858 involves multiple buffer overflow vulnerabilities in the AceManager Web API of the ALEOS platform. Connected sources indicate the affected software is ALEOS with vulnerable AceManager Web API versions prior to 4.13.0 , 4.9.5 , and 4.4.9 . The root cause is described as buffer overf...
CVE-2019-11853
ALEOS AT command interface exposes several potential command injection vulnerabilities in versions prior to 4.11.0 and 4.9.4. Connected CNVD/NVD entries confirm the issue affects ALEOS and reference affected versions; no additional exploitation details are provided in the sources. Remediation gui...
CVE-2019-11853 ALEOS AT Command Injections
Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4...
CVE-2019-11859
CVE-2019-11859 affects ALEOS and its SMS Handler API. A buffer overflow in the SMS handler prior to versions 4.13.0, 4.9.5, and 4.9.4 may allow code execution as root. Connected sources corroborate the vulnerability in the SMS handling path and list vulnerable version ranges, with patch/stabiliza...
CVE-2019-11859 ALEOS SMS Handler Buffer Overflow
A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root...
CVE-2019-11857
The CVE-2019-11857 entry concerns ALEOS ACEOS AceManager prior to versions 4.12.0, 4.9.5, and 4.4.9. The root cause is lack of input sanitization/validation in AceManager, leading to disclosure of sensitive system information. The vulnerability affects ACEOS/ALEOS components handling input in Ace...
CVE-2019-11857 ALEOS AceManager Information Disclosure
Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...
CVE-2019-11856 ALEOS ACEView Message Replay
A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials...