High ICSA-23-026-04 2 CVEs

Sierra Wireless AirLink Router with ALEOS Software

Published Jan 26, 2023 · Updated Jan 26, 2023

Vendor: Sierra Wireless Product: Airlink Router (ES450, GX450) running ALEOS software Product: Airlink Router (MP70, RV50, RV50x, RV55, LX 40, LX60) running ALEOS software

Summary

Successful exploitation of these vulnerabilities could allow a loss of sensitive information and could allow remote code execution.

Vulnerabilities 2

High 8.8

CVE-2022-46649 Public exploit

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to …

Feb 10, 2023
Medium 4.9

CVE-2022-46650 EPSS 12%

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the AC…

Feb 10, 2023

Revision history

2023-01-26 #1
Publication Date

References

ICS Advisory ICSA-23-026-04 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-026-04
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf