Lucene search

SWICVELIST:CVE-2023-40464

HistoryDec 04, 2023 - 10:59 p.m.

CVE-2023-40464 Use of hardcoded certificate and private key

2023-12-0422:59:33

CWE-321

SWI

www.cve.org

cve-2023-40464

hardcoded certificate

private key

aleos 4.16.0

man in the middle attack

acemanager client

acemanager server

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

17.6%

JSON

Several versions of
ALEOS, including ALEOS 4.16.0, use a hardcoded

SSL certificate and
private key. An attacker with access to these items

could potentially
perform a man in the middle attack between the

ACEManager client
and ACEManager server.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ALEOS",
    "vendor": "SierraWireless",
    "versions": [
      {
        "lessThanOrEqual": "4.16",
        "status": "affected",
        "version": "4.10",
        "versionType": "Custom"
      },
      {
        "lessThanOrEqual": "4.9.8",
        "status": "affected",
        "version": "0",
        "versionType": "Custom"
      }
    ]
  }
]

References

source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

17.6%

JSON

Related for CVELIST:CVE-2023-40464