CVE-2019-11856 ALEOS ACEView Message Replay
Attackers can replay captured ACEView traffic to other gateways sharing credentials due to nonce reuse, bypassing authentication mechanisms.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11856?
CVE-2019-11856 is a low-severity vulnerability in n/a, published on 21 Aug 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials.
Weakness: CWE-294
Which versions are affected by CVE-2019-11856?
It affects 1 product.
Products include Sierrawireless Aleos.
How do I fix CVE-2019-11856?
No fix has been published for CVE-2019-11856 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-11856 being exploited?
There is no known exploitation of CVE-2019-11856 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h222-gcmc-vjfm.