FKIE_CVE-2023-40459

Vulnerability from fkie_nvd - Published: 2023-12-04 23:15 - Updated: 2024-11-21 08:19
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting within ten seconds of becoming unavailable.
References
security@sierrawireless.comhttps://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbsVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbsVendor Advisory
Impacted products
Vendor Product Version
sierrawireless aleos *
sierrawireless es450 -
sierrawireless gx450 -
sierrawireless lx40 -
sierrawireless lx60 -
sierrawireless mp70 -
sierrawireless rv50x -
sierrawireless rv55 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "45265DDA-E10F-49D0-B2C6-FC123C42E5AE",
              "versionEndIncluding": "4.16.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sierrawireless:es450:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "524DF1AE-21F2-4AA6-99E7-6F98304FF845",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:gx450:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C12CF71-FE0E-44EA-9F2E-7CFB42E7C216",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:lx40:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "069DD303-C100-4FAF-BD6B-4EE61CBDE9F7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:lx60:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A3B7B3D-1594-434B-8E22-01C67DF54F16",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:mp70:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "007D4629-4BE2-4C7A-AC8B-E87739E22D12",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:rv50x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "61D3EF27-E823-4E49-BD58-D050EB02D294",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:rv55:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "215BD4AB-8EFD-4F82-ABE4-E7F81AD528C2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\n\n\n\n\n\n\n\n\nThe\nACEManager component of ALEOS 4.16 and earlier does not adequately perform\ninput sanitization during authentication, which could potentially result in a\nDenial of Service (DoS) condition for ACEManager without impairing other router\nfunctions. ACEManager recovers from the DoS condition by restarting within ten\nseconds of becoming unavailable.\n\n\n\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "El componente ACEManager de ALEOS 4.16 y versiones anteriores no realiza adecuadamente la sanitizaci\u00f3n de entradas durante la autenticaci\u00f3n, lo que podr\u00eda resultar en una condici\u00f3n de denegaci\u00f3n de servicio (DoS) para ACEManager sin afectar otras funciones del router. ACEManager se recupera de la condici\u00f3n DoS reinici\u00e1ndose dentro de los diez segundos posteriores a que no est\u00e9 disponible."
    }
  ],
  "id": "CVE-2023-40459",
  "lastModified": "2024-11-21T08:19:30.840",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security@sierrawireless.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-12-04T23:15:24.933",
  "references": [
    {
      "source": "security@sierrawireless.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs"
    }
  ],
  "sourceIdentifier": "security@sierrawireless.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "security@sierrawireless.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.