CVE-2023-40463: Use of Hard-Coded Credentials
When configured in debugging mode by an authenticated user with
administrative privileges, ALEOS 4.16 and earlier store the SHA512
hash of the common root password for that version in a directory
accessible to a user with root privileges or equivalent access.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40463?
CVE-2023-40463 is a vulnerability that allows an authenticated user to access a directory containing the SHA512 hash of the common root password for ALEOS 4.16 and earlier versions.
What is the severity of CVE-2023-40463?
CVE-2023-40463 has a severity rating of 8.1 (High).
Which software versions are affected by CVE-2023-40463?
ALEOS 4.16 and earlier versions are affected by CVE-2023-40463.
How can an authenticated user exploit CVE-2023-40463?
An authenticated user with administrative privileges can enable debugging mode to access the directory containing the hashed root password.
Is the Sierrawireless Es450, Gx450, Lx40, Lx60, Mp70, Rv50x, or Rv55 affected by CVE-2023-40463?
No, Sierrawireless Es450, Gx450, Lx40, Lx60, Mp70, Rv50x, and Rv55 are not vulnerable to CVE-2023-40463.