CVE-2018-4063

CVE-2018-4063 affects Sierra Wireless AirLink ES450 FW 4.9.3. The vulnerability is in the ACEManager/upload.cgi functionality and allows an authenticated user to upload a file that results in executable code being uploaded to the webserver, enabling remote code execution. This is a unrestricted f...

CVE-2022-46650

CVE-2022-46650 affects ALEOS’ Acemanager prior to 4.16. Authenticated users can reconfigure the device to expose ACEManager credentials on the pre-login status page (root cause: credential disclosure on login-page flow). Public references confirm a CVSS v3.1 base score of 4.9 (Medium) with networ...

CVE-2022-46649

CVE-2022-46649 affects Acemanager in ALEOS prior to 4.16. An authenticated user can manipulate the IP logging operation to execute arbitrary shell commands on the device. Public material (e.g., Red Hat, NVD, Trellix blogs) confirms an authenticated command-injection vector with CVSS v3.1 base sco...

CVE-2023-40462

The CVE-2023-40462 issue affects Sierra Wireless AirLink ALEOS ACEManager (4.16 and earlier). The root cause is inadequate input sanitization during authentication, potentially enabling a DoS on ACEManager with a restart recovery within about ten seconds. The connected documents confirm the vulne...

CVE-2019-11851

The affected product is Sierra Wireless ALEOS, specifically the ACENet service. Affected ranges: before 4.4.9; 4.5.x through 4.9.x before 4.9.5; and 4.10.x through 4.13.x before 4.14.0. Root cause is a buffer overflow in ACENet that allows remote code execution. Exploitation status is not provide...

CVE-2019-11848

CVE-2019-11848 is an API abuse vulnerability in the ALEOS AT Command API. The issue arises from lack of length checking when handling certain user-supplied values, affecting ALEOS versions prior to 4.13.0, 4.9.5, and 4.4.9. The connected sources corroborate the affected component (AT Command API)...

CVE-2019-11850

CVE-2019-11850 is about a stack overflow in the AT command interface of ALEOS before version 4.11.0. The vulnerability exists in ALEOS, an embedded M2M development environment, and can lead to remote code execution, with exploitation demonstrated in versions prior to 4.11.0 per CNVD-2020-48629 an...

CVE-2015-6479

CVE-2015-6479 affects Sierra Wireless ACEmanager in ALEOS 4.4.2 and earlier on ES440, ES450, GX400, GX440, GX450, and LS300. It is a remote information-disclosure vulnerability that allows reading the filteredlogs.txt file, potentially exposing boot-sequence details. The issue is due to access to...

CVE-2019-11852

The connected CVE details show ALEOS ACEView Service in ALEOS is affected by an out-of-bounds read that can disclose sensitive information. Affected versions are prior to 4.13.0, 4.9.5, and 4.4.9, with the ACEView service accessible by default on the LAN. The root cause is an out-of-bounds read i...

CVE-2019-11859

CVE-2019-11859 affects ALEOS and its SMS Handler API. A buffer overflow in the SMS handler prior to versions 4.13.0, 4.9.5, and 4.9.4 may allow code execution as root. Connected sources corroborate the vulnerability in the SMS handling path and list vulnerable version ranges, with patch/stabiliza...

CVE-2019-11857

The CVE-2019-11857 entry concerns ALEOS ACEOS AceManager prior to versions 4.12.0, 4.9.5, and 4.4.9. The root cause is lack of input sanitization/validation in AceManager, leading to disclosure of sensitive system information. The vulnerability affects ACEOS/ALEOS components handling input in Ace...

CVE-2023-40463

CVE-2023-40463 affects Sierra Wireless AirLink ALEOS firmware (versions 4.16 and earlier). The root cause is in debugging mode: when enabled by an authenticated user with administrative privileges, ALEOS stores the SHA-512 hash of the common root password in a directory accessible to a user with ...

CVE-2018-10251

CVE-2018-10251 affects Sierra Wireless AirLink routers: GX400, GX440, ES440, LS300 (firmware < 4.4.7) and GX450, ES450, RV50, RV50X, MP70, MP70E (firmware

CVE-2019-11847

CVE-2019-11847 describes a privilege management flaw in ALEOS prior to 4.11.0, 4.9.4, and 4.4.9. An authenticated user can escalate to root via the command shell due to mismanagement of privileges. Affected product context refers to ALEOS (embedded M2M/IDE environment). The available sources stat...

CVE-2019-11853

ALEOS AT command interface exposes several potential command injection vulnerabilities in versions prior to 4.11.0 and 4.9.4. Connected CNVD/NVD entries confirm the issue affects ALEOS and reference affected versions; no additional exploitation details are provided in the sources. Remediation gui...

CVE-2019-11855

CVE-2019-11855 affects ALEOS gateway LAN: an RPC server is enabled by default in versions prior to 4.12.0, 4.9.5, and 4.4.9. The issue is exploitable over the network with no authentication (CVSSv3: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), implying high impact to confidentiality, integrity, and avai...

CVE-2019-11856

The CVE-2019-11856 entry covers a nonce-reuse vulnerability in the ACEView service of ALEOS prior to versions 4.13.0, 4.9.5, and 4.4.9. The issue allows replay of captured ACEView traffic to other gateways sharing the same credentials, enabling message replay. Affected component: ACEView service ...

CVE-2023-40459

The CVE-2023-40459 issue affects the ACEManager component in Sierra Wireless ALEOS firmware 4.16 and earlier, caused by inadequate input sanitization during authentication. This can lead to a Denial of Service (DoS) against ACEManager while other router functions remain operational. The vulnerabl...

CVE-2023-40461

CVE-2023-40461 : Stored Cross-Site Scripting in the ACEManager file upload field of Sierra Wireless AirLink ALEOS (versions 4.16 and earlier). An authenticated administrator can upload files with names that are not fully validated, enabling client-side script execution within ACEManager and affec...

CVE-2023-40464

CVE-2023-40464 concerns Sierra Wireless AirLink ALEOS firmware (incl. ALEOS 4.16.0 and earlier). The vulnerability stems from a hardcoded SSL certificate and private key used by the system, enabling a potential attacker with access to these artifacts to perform a man-in-the-middle attack between ...

CVE-2023-38321

OpenNDS (as used in Sierra Wireless ALEOS before 4.17.0.12 and related products) is affected by CVE-2023-38321. A GET request to /opennds_auth/ that omits a required custom query string parameter and client-token may trigger a NULL pointer dereference, causing a daemon crash and Captive Portal ou...

CVE-2015-2897

CVE-2015-2897 affects Sierra Wireless ALEOS on GX, ES, and LS gateways (before 4.4.2). The issue is multiple hard-coded root accounts that are enabled by default and reachable via SSH or TELNET, enabling a remote attacker to gain full administrative control. The CERT/CCE entry notes these credent...

CVE-2019-11858

CVE-2019-11858 involves multiple buffer overflow vulnerabilities in the AceManager Web API of the ALEOS platform. Connected sources indicate the affected software is ALEOS with vulnerable AceManager Web API versions prior to 4.13.0 , 4.9.5 , and 4.4.9 . The root cause is described as buffer overf...

CVE-2019-11862

The CVE affects the ALEOS SSH service prior to 4.12.0, 4.9.5, and 4.4.9, where the SSH service allows traffic proxying. The provided data includes CVSSv3.1 metrics (AV:L, AC:L, PR:N, UI:N, S:U; C/H/I/H/A/H; base 8.4) and CVSSv2 metrics (base 4.6) indicating HIGH impact on confidentiality, integri...

CVE-2020-8781

CVE-2020-8781 affects ALEOS 4.11 and later, where UpdateRebootMgr’s input sanitization is insufficient, enabling a low-privilege process to escalate to root. The connected documents confirm the vulnerability and its root cause but do not provide exploit details or explicit remediation steps; no i...

CVE-2020-8782

The CVE-2020-8782 entry details a vulnerability in Sierra Wireless ALEOS (AirLink gateways) where an unauthenticated RPC server in ALEOS versions prior to 4.4.9, 4.9.5, and before 4.14.0 allows remote code execution. Affected component: ALEOS RPC service; root cause: unauthenticated RPC interface...

CVE-2019-11849

ALEOS (embedded M2M) prior to version 4.11.0 contains a stack overflow vulnerability in the AT Command API that can enable code execution. The CNVD-2020-48628 entry confirms the issue in ALEOS and specifies the affected component (AT Command API) and the vulnerable range (before 4.11.0). Practica...

CVE-2023-40458

The CVE-2023-40458 vulnerability affects Sierra Wireless AirLink ALEOS ACEManager (ACEManager component) and is a Loop with Unreachable Exit Condition (Infinite Loop) that can allow a remote attacker to trigger a Denial of Service (DoS) without impairing other router functions. Affected products/...

CVE-2023-40460

CVE-2023-40460 affects the ACEManager component of ALEOS 4.16 and earlier . The vulnerability arises because ACEManager does not validate uploaded file names and types, which could allow an authenticated user to execute client-side scripts within ACEManager and alter device functionality until a ...

CVE-2023-40465

CVE-2023-40465 affects Sierra Wireless ALEOS (including 4.16.0 and earlier). A third‑party open‑source component included in ALEOS can be exploited from the local network, causing a Denial of Service (captive portal) condition. Mitigation: update to ALEOS 4.17+ or apply vendor guidance/workaround...