Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2023-40460

Improper input leads to DoS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
SWI

Description

The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until the device is restarted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SierraWireless ALEOS

Default version status: unaffected

  • 4.10 to ≤ 4.16affected
  • 0 to ≤ 4.9.8affected

References