{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-23T19:57:17.991","vulnerabilities":[{"cve":{"id":"CVE-2023-40460","sourceIdentifier":"security@sierrawireless.com","published":"2023-12-04T23:15:25.180","lastModified":"2024-11-21T08:19:30.983","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"\n\n\n\n\n\n\n\n\n\nThe ACEManager\ncomponent of ALEOS 4.16 and earlier does not\n\n\n\nvalidate uploaded\nfile names and types, which could potentially allow\n\n\n\nan authenticated\nuser to perform client-side script execution within\n\n\n\nACEManager, altering\nthe device functionality until the device is\n\n\n\nrestarted.\n\n\n\n\n\n\n\n"},{"lang":"es","value":"El componente ACEManager de ALEOS 4.16 y versiones anteriores no valida los nombres y tipos de archivos cargados, lo que podría permitir a un usuario autenticado realizar la ejecución de scripts del lado del cliente dentro de ACEManager, alterando la funcionalidad del dispositivo hasta que se reinicie."}],"metrics":{"cvssMetricV31":[{"source":"security@sierrawireless.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}]},"weaknesses":[{"source":"security@sierrawireless.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-434"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*","versionEndIncluding":"4.16.0","matchCriteriaId":"45265DDA-E10F-49D0-B2C6-FC123C42E5AE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:es450:-:*:*:*:*:*:*:*","matchCriteriaId":"524DF1AE-21F2-4AA6-99E7-6F98304FF845"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:gx450:-:*:*:*:*:*:*:*","matchCriteriaId":"2C12CF71-FE0E-44EA-9F2E-7CFB42E7C216"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:lx40:-:*:*:*:*:*:*:*","matchCriteriaId":"069DD303-C100-4FAF-BD6B-4EE61CBDE9F7"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:lx60:-:*:*:*:*:*:*:*","matchCriteriaId":"2A3B7B3D-1594-434B-8E22-01C67DF54F16"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:mp70:-:*:*:*:*:*:*:*","matchCriteriaId":"007D4629-4BE2-4C7A-AC8B-E87739E22D12"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:rv50x:-:*:*:*:*:*:*:*","matchCriteriaId":"61D3EF27-E823-4E49-BD58-D050EB02D294"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:rv55:-:*:*:*:*:*:*:*","matchCriteriaId":"215BD4AB-8EFD-4F82-ABE4-E7F81AD528C2"}]}]}],"references":[{"url":"https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.5ZcnyPM1.dpbs","source":"security@sierrawireless.com","tags":["Vendor Advisory"]},{"url":"https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.5ZcnyPM1.dpbs","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}