High · 8.1 CVE-2023-40461 EUVD-2023-45032GHSA-78cf-35f9-pxqf

Cross-site scripting vulnerability in ACEManager

Published Dec 4, 2023 · Updated Feb 25, 2026 · Assigned by SWI

Description

The ACEManager
component of ALEOS 4.16 and earlier allows an

authenticated user
with Administrator privileges to access a file

upload field which
does not fully validate the file name, creating a

Stored Cross-Site
Scripting condition.

Vendor	Product	Affected	Fixed
SierraWireless	ALEOS	4.10 – ≤ 4.16, ≤ 4.9.8	—