CVE-2023-40460 — Improper input leads to DoS

Description (CNA)

The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until the device is restarted.

Affected (CNA)

Vendor / product	Versions
SierraWireless / ALEOS	affected 4.10 through 4.16; affected 0 through 4.9.8

CWE

CWE-434, CWE-79

References

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.5ZcnyPM1.dpbs

ADP enrichment

CVE

No English description supplied.

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.5ZcnyPM1.dpbs

CISA-ADP

No English description supplied.

No references supplied.