CVE-2023-40460: Improper input leads to DoS
The ACEManager component of ALEOS 4.16 and earlier does not
validate uploaded file names and types, which could potentially allow
an authenticated user to perform client-side script execution within
ACEManager, altering the device functionality until the device is
restarted.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40460?
CVE-2023-40460 is a vulnerability in the ACEManager component of ALEOS 4.16 and earlier that allows an authenticated user to perform client-side script execution within ACEManager, potentially altering the device functionality.
Which software versions are affected by CVE-2023-40460?
ALEOS versions up to and including 4.16.0 are affected by CVE-2023-40460.
What is the severity of CVE-2023-40460?
CVE-2023-40460 has a severity rating of 7.1, which is considered high.
How can an authenticated user exploit CVE-2023-40460?
An authenticated user can exploit CVE-2023-40460 by uploading a file with a malicious name or type, which can result in client-side script execution within ACEManager.
Is there a fix available for CVE-2023-40460?
Sierrawireless has released a security bulletin with details on mitigations for CVE-2023-40460. Please refer to the provided reference for more information.