AL
Product
ALEOS
On CISA KEVExploited in the wild
30
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 14Medium 9Low 1
Watch
Add ALEOS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-4063 In wildKEV | 8.8 | May 6 | Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability Affected: before 4.4.9; before 4.11.0; before 4.9.4 |
| CVE-2019-11851 | 9.8 | Dec 26 | The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary… Affected: 4.10.0 before 4.14.0; 4.5.0 before 4.9.5; before 4.4.9 |
| CVE-2020-8782 | 9.8 | Oct 6 | Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution Affected: before 4.4.9; 4.5.0 before 4.9.5; 4.10.0 before 4.14.0 |
| CVE-2019-11855 | 9.8 | Aug 21 | An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9 Affected: before 4.12.0; before 4.9.5; before 4.4.9 |
| CVE-2018-10251 | 9.8 | May 4 | A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware… Affected: before 4.4.7; before 4.9.3 |
| CVE-2019-11852 | 9.1 | Aug 21 | An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 Affected: before 4.13.0; before 4.9.5; before 4.4.9 |
| CVE-2022-46649 | 8.8 | Feb 10 | Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device Affected: through 4.9.7; through 4.16.0 |
| CVE-2019-11859 | 8.8 | Aug 21 | A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root Affected: through 4.12.0; through 4.9.4; through 4.4.8 |
| CVE-2019-11862 | 8.4 | Aug 21 | The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying Affected: before 4.4.9; 4.9.0 before 4.9.5 |
| CVE-2020-8781 | 7.8 | Oct 6 | Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process Affected: 4.11.0 before 4.14.0 |
| CVE-2019-11847 | 7.8 | Aug 21 | An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9 Affected: before 4.11.0; before 4.9.4; before 4.4.9 |
| CVE-2023-38321 | 7.5 | Dec 25 | OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and… Affected: before 4.17.0.12 |
| CVE-2023-40462 | 7.5 | Dec 4 | Improper input leads to DoS Affected: 4.10 through 4.16; through 4.9.8 |
| CVE-2023-40459 | 7.5 | Dec 4 | Improper input leads to DoS Affected: 4.10 through 4.16; through 4.9.8 |
| CVE-2023-40458 | 7.5 | Nov 29 | AceManager DOS Vulnerability Affected: 4.10.0 through 4.16; through 4.9.8 |
| CVE-2023-40463 | 7.2 | Dec 4 | Use of Hard-Coded Credentials Affected: 4.10 through 4.16; through 4.9.8 |
| CVE-2019-11858 | 7.2 | Aug 21 | Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9 Affected: through 4.12.0; through 4.9.4; through 4.4.8 |
| CVE-2019-11853 | 7.2 | Aug 21 | Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4 Affected: before 4.11.0; before 4.9.4 |
| CVE-2019-11848 | 7.2 | Aug 21 | An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values Affected: before 4.13.0; before 4.9.5; before 4.4.9 |
| CVE-2023-40464 | 6.8 | Dec 4 | Use of hardcoded certificate and private key Affected: 4.10 through 4.16; through 4.9.8 |
| CVE-2019-11850 | 6.7 | Aug 21 | A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0 Affected: before 4.11.0 |
| CVE-2019-11849 | 6.7 | Aug 21 | A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0 Affected: before 4.11.0 |
| CVE-2023-40465 | 5.5 | Dec 4 | Improper input leads to DoS Affected: 4.10 through 4.16; through 4.9.8 |
| CVE-2023-40460 | 5.4 | Dec 4 | Improper input leads to DoS Affected: 4.10 through 4.16; through 4.9.8 |
| CVE-2022-46650 | 4.9 | Feb 10 | Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page Affected: through 4.9.7; through 4.16.0 |
| CVE-2019-11857 | 4.9 | Aug 21 | Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information Affected: before 4.12.0; through 4.9.4; through 4.4.8 |
| CVE-2023-40461 | 4.8 | Dec 4 | Cross-site scripting vulnerability in ACEManager Affected: 4.10 through 4.16; through 4.9.8 |
| CVE-2015-6479 | 4.3 | Apr 21 | ACEmanager in Sierra Wireless ALEOS 4.4.2 and earlier on ES440, ES450, GX400, GX440, GX450, and LS300 devices allows remote attackers to read the filteredlogs.txt file, and… Affected: through 4.4.2 |
| CVE-2019-11856 | 3.8 | Aug 21 | A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay Affected: through 4.12.0; through 4.9.4; through 4.4.8 |
| CVE-2015-2897 | – | Aug 8 | Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a… Affected: through 4.4.1 |
Showing 30