CVE-2023-40460 (published 2023-12-04T22:50:04.200Z)










The ACEManager
component of ALEOS 4.16 and earlier does not



validate uploaded
file names and types, which could potentially allow



an authenticated
user to perform client-side script execution within



ACEManager, altering
the device functionality until the device is



restarted.








Affected products: Vendor: SierraWireless
Product: ALEOS
Versions: 4.10, 0