Credential Exposure in ALEOS by Sierra Wireless
CVE-2022-46650

4.9MEDIUM

Key Information:

Vendor

Sierrawireless

Status
Aleos
Vendor
CVE Published:
10 February 2023

What is CVE-2022-46650?

A vulnerability in ACEManager within ALEOS versions prior to 4.16 enables authenticated users to reconfigure the device, inadvertently exposing ACEManager credentials on the pre-login status page. This flaw presents a significant risk as it may allow unauthorized access to sensitive configurations and compromise the security of affected devices.

Affected Version(s)

ALEOS all versions before 4.16

References

https://source.sierrawireless.com/resources/security-bull...
https://www.otorio.com/blog/airlink-acemanager-vulnerabil...
https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-04

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.