CVE-2023-40463: Use of Hard-Coded Credentials
First published: Mon Dec 04 2023(Updated: )
When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalent access.
Credit: security@sierrawireless.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Sierra Wireless ALEOS | <=4.16.0 | |
| Any of | ||
| Sierra Wireless AirLink ES450 | ||
| Sierra Wireless AirLink GX450 | ||
| Sierra Wireless AirLink LX40 | ||
| Sierra Wireless AirLink LX60 | ||
| Sierra Wireless AirLink MP70 | ||
| Sierra Wireless AirLink RV50X | ||
| Sierra Wireless AirLink RV55 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-40463?
CVE-2023-40463 is a vulnerability that allows an authenticated user to access a directory containing the SHA512 hash of the common root password for ALEOS 4.16 and earlier versions.
What is the severity of CVE-2023-40463?
CVE-2023-40463 has a severity rating of 8.1 (High).
Which software versions are affected by CVE-2023-40463?
ALEOS 4.16 and earlier versions are affected by CVE-2023-40463.
How can an authenticated user exploit CVE-2023-40463?
An authenticated user with administrative privileges can enable debugging mode to access the directory containing the hashed root password.
Is the Sierrawireless Es450, Gx450, Lx40, Lx60, Mp70, Rv50x, or Rv55 affected by CVE-2023-40463?
No, Sierrawireless Es450, Gx450, Lx40, Lx60, Mp70, Rv50x, and Rv55 are not vulnerable to CVE-2023-40463.
- agent/type
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- vendor/sierrawireless
- canonical/sierra wireless aleos
- version/sierra wireless aleos/4.16.0
- canonical/sierra wireless airlink es450
- canonical/sierra wireless airlink gx450
- canonical/sierra wireless airlink lx40
- canonical/sierra wireless airlink lx60
- canonical/sierra wireless airlink mp70
- canonical/sierra wireless airlink rv50x
- canonical/sierra wireless airlink rv55