Vulnerabilities > CVE-2023-40462 - Reachable Assertion vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

sierrawireless

debian

CWE-617

NVD

Published: 2023-12-04

Updated: 2024-11-21

Summary

The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting within ten seconds of becoming unavailable.

Vulnerable Configurations

Part	Description	Count
OS	Sierrawireless Sierrawireless Aleos 4.3.0 Sierrawireless Aleos 4.3.1 Sierrawireless Aleos 4.3.2 Sierrawireless Aleos 4.3.3 Sierrawireless Aleos 4.3.4 Sierrawireless Aleos 4.3.5 Sierrawireless Aleos 4.3.6 Sierrawireless Aleos 4.4.0 Sierrawireless Aleos 4.4.1 Sierrawireless Aleos 4.4.2 Sierrawireless Aleos 4.4.3 Sierrawireless Aleos 4.4.4 Sierrawireless Aleos 4.4.5 Sierrawireless Aleos 4.4.6 Sierrawireless Aleos 4.4.7 Sierrawireless Aleos 4.4.8 Sierrawireless Aleos 4.4.9 Sierrawireless Aleos 4.5.0 Sierrawireless Aleos 4.5.1 Sierrawireless Aleos 4.5.2 Sierrawireless Aleos 4.6.0 Sierrawireless Aleos 4.6.1 Sierrawireless Aleos 4.6.2 Sierrawireless Aleos 4.7.0 Sierrawireless Aleos 4.8.0 Sierrawireless Aleos 4.8.1 Sierrawireless Aleos 4.9.0 Sierrawireless Aleos 4.9.1 Sierrawireless Aleos 4.9.2 Sierrawireless Aleos 4.9.3 Sierrawireless Aleos 4.9.4 Sierrawireless Aleos 4.9.5 Sierrawireless Aleos 4.10.0 Sierrawireless Aleos 4.10.1 Sierrawireless Aleos 4.11.0 Sierrawireless Aleos 4.11.1 Sierrawireless Aleos 4.11.2 Sierrawireless Aleos 4.12.0 Sierrawireless Aleos 4.13.0 Sierrawireless Aleos 4.14.0	40
OS	Debian Debian Debian Linux 10.0	1
Hardware	Sierrawireless Sierrawireless Es450 - Sierrawireless Gx450 - Sierrawireless Lx40 - Sierrawireless Lx60 - Sierrawireless Mp70 - Sierrawireless Rv50X - Sierrawireless Rv55 -	7

Common Weakness Enumeration (CWE)

CWE-617 - Reachable Assertion

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References