CVE-2023-40459: Improper input leads to DoS
The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting within ten seconds of becoming unavailable.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40459?
CVE-2023-40459 is a vulnerability in the ACEManager component of ALEOS 4.16 and earlier that allows for improper input leading to a Denial of Service (DoS) condition.
How does CVE-2023-40459 affect Sierrawireless Aleos?
Sierrawireless Aleos versions up to 4.16.0 are affected by CVE-2023-40459.
How severe is CVE-2023-40459?
CVE-2023-40459 is considered to have a severity level of 7.5 (high).
How can CVE-2023-40459 be exploited?
To exploit CVE-2023-40459, an attacker can send specially crafted input during the authentication process in ACEManager, which can cause a DoS condition.
Is there a fix available for CVE-2023-40459?
Sierrawireless has released a fix for CVE-2023-40459. It is recommended to update to a version of ALEOS that is later than 4.16.0.