Cross site scripting

An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9. Sensitive information may be disclosed via the ACEviewservice, accessible by default on the LAN...

Design/Logic Flaw

A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials...

Stack overflow

A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution...

Command injection

Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4...

Design/Logic Flaw

An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shell...

Default credentials

An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9...

CVE-2019-11862 ALEOS SSH Service Allows Traffic Proxying

The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying...

CVE-2019-11862

The CVE affects the ALEOS SSH service prior to 4.12.0, 4.9.5, and 4.4.9, where the SSH service allows traffic proxying. The provided data includes CVSSv3.1 metrics (AV:L, AC:L, PR:N, UI:N, S:U; C/H/I/H/A/H; base 8.4) and CVSSv2 metrics (base 4.6) indicating HIGH impact on confidentiality, integri...

CVE-2019-11858 ALEOS Multiple Web UI vulnerabilities

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9...

CVE-2019-11858

CVE-2019-11858 involves multiple buffer overflow vulnerabilities in the AceManager Web API of the ALEOS platform. Connected sources indicate the affected software is ALEOS with vulnerable AceManager Web API versions prior to 4.13.0 , 4.9.5 , and 4.4.9 . The root cause is described as buffer overf...

CVE-2019-11853 ALEOS AT Command Injections

Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4...

CVE-2019-11853

ALEOS AT command interface exposes several potential command injection vulnerabilities in versions prior to 4.11.0 and 4.9.4. Connected CNVD/NVD entries confirm the issue affects ALEOS and reference affected versions; no additional exploitation details are provided in the sources. Remediation gui...

CVE-2019-11859 ALEOS SMS Handler Buffer Overflow

A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root...

CVE-2019-11859

CVE-2019-11859 affects ALEOS and its SMS Handler API. A buffer overflow in the SMS handler prior to versions 4.13.0, 4.9.5, and 4.9.4 may allow code execution as root. Connected sources corroborate the vulnerability in the SMS handling path and list vulnerable version ranges, with patch/stabiliza...

CVE-2019-11857 ALEOS AceManager Information Disclosure

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information...

CVE-2019-11857

The CVE-2019-11857 entry concerns ALEOS ACEOS AceManager prior to versions 4.12.0, 4.9.5, and 4.4.9. The root cause is lack of input sanitization/validation in AceManager, leading to disclosure of sensitive system information. The vulnerability affects ACEOS/ALEOS components handling input in Ace...

CVE-2019-11856 ALEOS ACEView Message Replay

A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials...

CVE-2019-11856

The CVE-2019-11856 entry covers a nonce-reuse vulnerability in the ACEView service of ALEOS prior to versions 4.13.0, 4.9.5, and 4.4.9. The issue allows replay of captured ACEView traffic to other gateways sharing the same credentials, enabling message replay. Affected component: ACEView service ...

CVE-2019-11855 ALEOS LAN-Side RPC Server

An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9...

CVE-2019-11855

CVE-2019-11855 affects ALEOS gateway LAN: an RPC server is enabled by default in versions prior to 4.12.0, 4.9.5, and 4.4.9. The issue is exploitable over the network with no authentication (CVSSv3: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), implying high impact to confidentiality, integrity, and avai...