CVE-2023-40462 Improper input leads to DoS
Attackers can cause a temporary denial of service in the ACEManager component of Sierra Wireless ALEOS devices due to improper input sanitization during authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-40462?
CVE-2023-40462 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 4 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ACEManager component of ALEOS 4.16 and earlier does not
perform input sanitization during authentication, which could
potentially result in a Denial of Service (DoS) condition for
ACEManager without impairing other router functions. ACEManager
recovers from the DoS condition by restarting within ten seconds of
becoming unavailable.
Weakness: CWE-617
Which versions are affected by CVE-2023-40462?
It affects 2 products.
Products include Debian Debian Linux, Sierrawireless Aleos.
How do I fix CVE-2023-40462?
No fix has been published for CVE-2023-40462 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-40462 being exploited?
There is no known exploitation of CVE-2023-40462 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-2fh4-45ph-7q27.