CVE-2023-40463

Published: Dec 4, 2023Modified: Nov 21, 2024

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalent access.

Affected (1)

Products: Sierrawireless: Aleos

Sierrawireless

1 product

Aleos

Configuration A

1 vulnerable · 7 platform

Vulnerable Software	Affected Versions
Sierrawireless Aleos	Up to 4.16.0

Running on/with	Platform Versions
Sierrawireless Es450	All versions
Sierrawireless Gx450	All versions
Sierrawireless Lx40	All versions
Sierrawireless Lx60	All versions
Sierrawireless Mp70	All versions
Sierrawireless Rv50x	All versions
Sierrawireless Rv55	All versions

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (2)

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs

Source: security@sierrawireless.com

Vendor Advisory

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.