Sierrawireless Aleos
30 CVEs affecting Sierrawireless Aleos. Latest disclosed: 2023-12-25. Critical: 3, High: 16.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11851 | Critical | 9.8 | 2022-12-26 | The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to… |
CVE-2018-10251 | Critical | 9.8 | 2018-05-04 | A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E rou… |
CVE-2019-11857 | Critical | 9.1 | 2020-08-21 | Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information. |
CVE-2022-46649 | High | 8.8 | 2023-02-10 | Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the… |
CVE-2018-4063 | High | 8.8 | 2019-05-06 | An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP r… |
CVE-2023-40465 | High | 8.3 | 2023-12-04 | Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local area netwo… |
CVE-2023-40464 | High | 8.1 | 2023-12-04 | Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items coul… |
CVE-2023-40463 | High | 8.1 | 2023-12-04 | When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the… |
CVE-2023-40461 | High | 8.1 | 2023-12-04 | The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload field whi… |
CVE-2019-11862 | High | 8.1 | 2020-08-21 | The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying. |
CVE-2019-11855 | High | 8.1 | 2020-08-21 | An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9. |
CVE-2020-8781 | High | 7.8 | 2020-10-06 | Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process. |
CVE-2023-38321 | High | 7.5 | 2023-12-25 | OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference… |
CVE-2023-40462 | High | 7.5 | 2023-12-04 | The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial… |
CVE-2023-40459 | High | 7.5 | 2023-12-04 | The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially resul… |
CVE-2023-40458 | High | 7.5 | 2023-11-29 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a Deni… |
CVE-2020-8782 | High | 7.5 | 2020-10-06 | Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution. |
CVE-2019-11847 | High | 7.3 | 2020-08-21 | An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shel… |
CVE-2023-40460 | High | 7.1 | 2023-12-04 | The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authentica… |
CVE-2019-11850 | Medium | 6.3 | 2020-08-21 | A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution |