CVE-2023-40463

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

When configured in debugging mode by an authenticated user with

administrative privileges, ALEOS 4.16 and earlier store the SHA512

hash of the common root password for that version in a directory

accessible to a user with root privileges or equivalent access.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

VendorProductVersions
SierraWirelessALEOS>= 4.10, <= 4.16; <= 4.9.8

References

Timeline

Published
Dec 4, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-404646.8Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these itemCVE-2023-404655.5Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local aCVE-2023-404685.5PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to dCVE-2023-404695.5PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to dCVE-2023-40478.8A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vCVE-2023-404705.5PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to dCVE-2023-404717.8PDF-XChange Editor App Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execCVE-2023-404727.8PDF-XChange Editor JavaScript String Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attCVE-2023-404735.5PDF-XChange Editor Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclosCVE-2023-404748.8GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitCVE-2023-404758.8GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitCVE-2023-404768.8GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut
CVE-2023-40463: High severity, CVSS 7.2 | Vulnix