CVE-2023-40459 Improper input leads to DoS

High 7.5 Published 4 Dec 2023 Updated 29 May 2025

Attackers can cause a temporary denial of service in ACEManager via improper input sanitization during authentication on Sierra Wireless ALEOS devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-40459?

CVE-2023-40459 is a high-severity denial of service vulnerability in SierraWireless ALEOS, published on 4 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting within ten seconds of becoming unavailable.

Weakness: CWE-476

Which versions are affected by CVE-2023-40459?

It affects 1 product.

Products include Sierrawireless Aleos.

How do I fix CVE-2023-40459?

No fix has been published for CVE-2023-40459 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-40459 being exploited?

There is no known exploitation of CVE-2023-40459 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Sources

Also known as GHSA-mrh4-hf55-27fq.