CVE-2023-40463 : When configured in debugging mode by an authenticated user with administrativ

When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalent access.

Published 2023-12-04 23:15:26

Updated 2023-12-08 15:46:41

Source Sierra Wireless Inc.

View at NVD, CVE.org

Products affected by CVE-2023-40463

Sierrawireless » Aleos
Versions up to, including, (<=) 4.16.0
cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sierrawireless » Es450 » Version: N/A
When used together with: Sierrawireless » Gx450 » Version: N/A
When used together with: Sierrawireless » Lx40 » Version: N/A
When used together with: Sierrawireless » Lx60 » Version: N/A
When used together with: Sierrawireless » Mp70 » Version: N/A
When used together with: Sierrawireless » Rv50x » Version: N/A
When used together with: Sierrawireless » Rv55 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-40463

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 58 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-40463

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	Sierra Wireless Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-40463

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.
Assigned by:
- nvd@nist.gov (Primary)
- security@sierrawireless.com (Secondary)

References for CVE-2023-40463

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs

Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-40463

Products affected by CVE-2023-40463

Exploit prediction scoring system (EPSS) score for CVE-2023-40463

CVSS scores for CVE-2023-40463

CWE ids for CVE-2023-40463

References for CVE-2023-40463