CVE-2023-40461 is a Stored Cross-Site Scripting (XSS) vulnerability in the ACEManager component of ALEOS 4.16 and earlier, affecting various Sierra Wireless routers. This medium-severity vulnerability (CVSS 4.8) allows an authenticated administrator to inject malicious scripts due to insufficient file name validation during upload. While not actively exploited in the wild and lacking public exploit code, its presence in critical infrastructure routers warrants attention, as evidenced by limited community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.16.0CPE matchmatch criteria | cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* | ||
>= 4.10, <= 4.16CPE match | cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* | ||
>= 0, <= 4.9.8CPE match | cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.