CVE-2023-38321

< 4.17.0.12

OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of servic

7.5HIGH

CVE-2023-40465

<= 4.16.0

Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the

8.3HIGH

CVE-2023-40464

<= 4.16.0

Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to

8.1HIGH

CVE-2023-40463

<= 4.16.0

When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA

8.1HIGH

CVE-2023-40462

<= 4.16.0

The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could po

7.5HIGH

CVE-2023-40461

<= 4.16.0

The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file

8.1HIGH

CVE-2023-40460

<= 4.16.0

The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially all

7.1HIGH

CVE-2023-40459

<= 4.16.0

The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which cou

7.5HIGH

CVE-2023-40458

<= 4.9.8

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remot

7.5HIGH

CVE-2022-46650

<= 4.9.7

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager cr

4.9MEDIUM

CVE-2022-46649

<= 4.9.7

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arb

8.8HIGH

CVE-2019-11851

>= 4.10.0 and < 4.14.0

The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.

9.8CRITICAL

CVE-2020-8782

< 4.4.9

Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.

7.5HIGH

CVE-2020-8781

>= 4.11.0 and < 4.14.0

Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege pro

7.8HIGH

CVE-2019-11862

< 4.4.9

The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying.

8.1HIGH

CVE-2019-11859

<= 4.12.0

A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root.

6.0MEDIUM

CVE-2019-11858

<= 4.12.0

Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9.

5.7MEDIUM

CVE-2019-11857

< 4.12.0

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information

9.1CRITICAL

CVE-2019-11856

<= 4.12.0

A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captur

3.3LOW

CVE-2019-11855

< 4.12.0

An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9.

8.1HIGH

CVE-2019-11853

< 4.11.0

Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4.

3.9LOW

CVE-2019-11852

< 4.13.0

An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9. Sensitive information

3.7LOW

CVE-2019-11850

< 4.11.0

A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code executi

6.3MEDIUM

CVE-2019-11849

< 4.11.0

A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution.

6.3MEDIUM

CVE-2019-11848

< 4.13.0

An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when h

4.1MEDIUM

CVE-2019-11847

< 4.11.0

An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate

7.3HIGH

CVE-2018-4063

< 4.4.9

An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.

8.8HIGH

CVE-2018-10251

< 4.4.7

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV5

9.8CRITICAL

CVE-2015-6479

<= 4.4.2

ACEmanager in Sierra Wireless ALEOS 4.4.2 and earlier on ES440, ES450, GX400, GX440, GX450, and LS300 devices allows remote attack

4.3MEDIUM

CVE-2015-2897

<= 4.4.1

Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote