The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary code via a buffer overflow.

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device.

Several versions of ALEOS, including ALEOS 4.16.0, include an opensource

third-party component which can be exploited from the local

area network, resulting in a Denial of Service condition for the captive portal.

When configured in debugging mode by an authenticated user with

administrative privileges, ALEOS 4.16 and earlier store the SHA512

hash of the common root password for that version in a directory

accessible to a user with root privileges or equivalent access.

The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting within ten seconds of becoming unavailable.

The ACEManager component of ALEOS 4.16 and earlier does not

perform input sanitization during authentication, which could

potentially result in a Denial of Service (DoS) condition for

ACEManager without impairing other router functions. ACEManager

recovers from the DoS condition by restarting within ten seconds of

becoming unavailable.

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page.