Description
Several versions of
ALEOS, including ALEOS 4.16.0, use a hardcoded
SSL certificate and
private key. An attacker with access to these items
could potentially
perform a man in the middle attack between the
ACEManager client
and ACEManager server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SierraWireless | ALEOS | 4.10 – ≤ 4.16, ≤ 4.9.8 | — |
Advisories 1
- ICSA-23-341-06 Sierra Wireless AirLink with ALEOS firmware CISA ICS & IT advisories · Dec 7, 2023