CVE-2023-40458 is an infinite loop vulnerability in Sierra Wireless ALEOS that could allow a remote attacker to cause a Denial of Service (DoS) condition for ACEManager, though other router functions remain unaffected. Rated 7.5 HIGH on CVSS, this vulnerability is easily exploitable over the network with low attack complexity, leading to high availability impact requiring a device restart to clear. Currently, there is no evidence of active exploitation, public exploit code, or Metasploit/Nuclei modules, despite some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.9.8CPE matchmatch criteria | cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* | ||
>= 4.10.0, <= 4.16.2CPE matchmatch criteria | cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* | ||
>= 4.10.0, <= 4.16CPE match | cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* | ||
>= 0, <= 4.9.8CPE match | cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.