« Volver al listado

CVE-2023-40465

Estado: ModificadaMedia (5.5)—

Several versions of ALEOS, including ALEOS 4.16.0, include an opensource

third-party component which can be exploited from the local

area network, resulting in a Denial of Service condition for the captive portal.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sierrawireless — Aleos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-40465",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@sierrawireless.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@sierrawireless.com",
      "affectedData": [
        {
          "vendor": "SierraWireless",
          "product": "ALEOS",
          "versions": [
            {
              "status": "affected",
              "version": "4.10",
              "versionType": "Custom",
              "lessThanOrEqual": "4.16"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "Custom",
              "lessThanOrEqual": "4.9.8"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-04T23:15:26.247",
  "references": [
    {
      "url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@sierrawireless.com"
    },
    {
      "url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@sierrawireless.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        },
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\n\n\n\n\n\n\n\n\n\nSeveral versions of\nALEOS, including ALEOS 4.16.0, include an opensource\n\n\n\nthird-party\ncomponent which can be exploited from the local\n\n\n\narea network,\nresulting in a Denial of Service condition for the captive portal.\n\n\n\n\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "Varias versiones de ALEOS, incluida ALEOS 4.16.0, incluyen un componente de terceros de código abierto que puede explotarse desde la red de área local, lo que genera una condición de denegación de servicio para el portal cautivo."
    }
  ],
  "lastModified": "2026-06-17T06:17:59.433",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45265DDA-E10F-49D0-B2C6-FC123C42E5AE",
              "versionEndIncluding": "4.16.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sierrawireless:es450:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "524DF1AE-21F2-4AA6-99E7-6F98304FF845"
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:gx450:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2C12CF71-FE0E-44EA-9F2E-7CFB42E7C216"
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:lx40:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "069DD303-C100-4FAF-BD6B-4EE61CBDE9F7"
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:lx60:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2A3B7B3D-1594-434B-8E22-01C67DF54F16"
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:mp70:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "007D4629-4BE2-4C7A-AC8B-E87739E22D12"
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:rv50x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "61D3EF27-E823-4E49-BD58-D050EB02D294"
            },
            {
              "criteria": "cpe:2.3:h:sierrawireless:rv55:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "215BD4AB-8EFD-4F82-ABE4-E7F81AD528C2"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@sierrawireless.com"
}