CVE-2023-40465— Improper input leads to DoS
Quick assessment
Affected
SierraWireless ALEOS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Sierra Wireless ALEOS（AAF）是加拿大Sierra Wireless公司的用于在Sierra Wireless AirLink网关中创建应用程序的框架。 Sierra Wireless ALEOS 4.16及之前版本存在安全漏洞，该漏洞源于包含一个开源组件，导致拒绝服务情况。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-40465
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper input leads to DoS
Source: CVE Program / CVE List V5
Vulnerability Description
Several versions of
ALEOS, including ALEOS 4.16.0, include an opensource
third-party
component which can be exploited from the local
area network,
resulting in a Denial of Service condition for the captive portal.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
Sierra Wireless ALEOS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Sierra Wireless ALEOS（AAF）是加拿大Sierra Wireless公司的用于在Sierra Wireless AirLink网关中创建应用程序的框架。 Sierra Wireless ALEOS 4.16及之前版本存在安全漏洞，该漏洞源于包含一个开源组件，导致拒绝服务情况。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SierraWireless | ALEOS | 4.10 ~ 4.16 | - |
|
II. Public POCs for CVE-2023-40465
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-40465
请登录查看更多情报信息。
Other References for CVE-2023-40465 (1)
Same Patch Batch · SierraWireless · 2023-12-04 · 7 CVEs total
| CVE-2023-40461 | 8.1 HIGH | Cross-site scripting vulnerability in ACEManager |
| CVE-2023-40463 | 8.1 HIGH | Use of Hard-Coded Credentials |
| CVE-2023-40464 | 8.1 HIGH | Use of hardcoded certificate and private key |
| CVE-2023-40459 | 7.5 HIGH | Improper input leads to DoS |
| CVE-2023-40462 | 7.5 HIGH | Improper input leads to DoS |
| CVE-2023-40460 | 7.1 HIGH | Improper input leads to DoS |
IV. Related Vulnerabilities
V. Comments for CVE-2023-40465
No comments yet