Skip to content
OpenAdvisories

Vendor

SierraWireless

8 known vulnerabilities.

SierraWireless at a glance

Last 12 months
0
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

ALEOS 8
All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 4.3
    CVE-2023-40465

    Improper input leads to DoS

    Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local area network, resulting in a Denial of Service condition for the captive portal.

    SierraWireless ALEOS
  • High 8.1
    CVE-2023-40464

    Use of hardcoded certificate and private key

    Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items could potentially perform a man in the middle attack between the ACEManager client and ACEManager server.

    SierraWireless ALEOS
  • High 8.1
    CVE-2023-40463

    Use of Hard-Coded Credentials

    When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalent access.

    SierraWireless ALEOS
  • High 7.5
    CVE-2023-40462

    Improper input leads to DoS

    The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager recovers fr…

    SierraWireless ALEOS
  • High 8.1
    CVE-2023-40461

    Cross-site scripting vulnerability in ACEManager

    The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload field which does not fully validate the file name, creating a Stored Cross-Site Scripting condition.

    SierraWireless ALEOS
  • High 7.1
    CVE-2023-40460

    Improper input leads to DoS

    The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until the devi…

    SierraWireless ALEOS
  • High 7.5
    CVE-2023-40459 Public exploit

    Improper input leads to DoS

    The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager …

    SierraWireless ALEOS
  • High 7.5
    CVE-2023-40458

    AceManager DOS Vulnerability

    Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a Denial of Service (DoS) condition for ACEManager without impairing other router functions. This condition…

    SierraWireless ALEOS tinyxml Ubuntu