The ACEManager component of ALEOS 4.16 and earlier does not

validate uploaded file names and types, which could potentially allow

an authenticated user to perform client-side script execution within

ACEManager, altering the device functionality until the device is

restarted.

The ACEManager component of ALEOS 4.16 and earlier allows an

authenticated user with Administrator privileges to access a file

upload field which does not fully validate the file name, creating a

Stored Cross-Site Scripting condition.

Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded

SSL certificate and private key. An attacker with access to these items

could potentially perform a man in the middle attack between the

ACEManager client and ACEManager server.

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /openndsauth/ that lacks a custom query string parameter and client-token.