Sierrawireless vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-38321 OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, dHigh 7.5 · Dec 25, 2023
• CVE-2023-40465 Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local area networHigh 8.3 · Dec 4, 2023
• CVE-2023-40464 Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key.High 8.1 · Dec 4, 2023
• CVE-2023-40463 When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the cHigh 8.1 · Dec 4, 2023
• CVE-2023-40462 The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial oHigh 7.5 · Dec 4, 2023
• CVE-2023-40461 The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload field whicHigh 8.1 · Dec 4, 2023
• CVE-2023-40460 The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticatHigh 7.1 · Dec 4, 2023
• CVE-2023-40459 The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially resultHigh 7.5 · Dec 4, 2023
• CVE-2023-40458 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a DeniaHigh 7.5 · Nov 29, 2023
• CVE-2022-46649 Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the dHigh 8.8 · Feb 10, 2023
• CVE-2019-11851 The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to eCritical 9.8 · Dec 26, 2022
• CVE-2020-11101 Sierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can obtain a login session with administratoCritical 9.8 · Dec 26, 2022
• CVE-2020-8782 Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.High 7.5 · Oct 6, 2020
• CVE-2020-8781 Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process.High 7.8 · Oct 6, 2020
• CVE-2019-11862 The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying.High 8.1 · Aug 21, 2020
• CVE-2019-11857 Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information.Critical 9.1 · Aug 21, 2020
• CVE-2019-11855 An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9.High 8.1 · Aug 21, 2020
• CVE-2019-11847 An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9.High 7.3 · Aug 21, 2020
• CVE-2020-8948 The Sierra Wireless Windows Mobile Broadband Driver Packages (MBDP) before build 5043 allows an unprivileged user to overwrite arbitrary files in arbitrary foldHigh 7.8 · Apr 15, 2020
• CVE-2018-4064 An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.High 7.1 · Oct 31, 2019
• CVE-2018-4073 An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.High 8.8 · May 6, 2019
• CVE-2018-4072 An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.High 8.8 · May 6, 2019
• CVE-2018-4071 An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.High 8.8 · May 6, 2019
• CVE-2018-4070 An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.High 8.8 · May 6, 2019
• CVE-2018-4066 An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3.High 8.8 · May 6, 2019