CVE-2023-40460 HIGH

CVE-2023-40460: Improper input leads to DoS

Vendor Sierrawireless
Product ALEOS
Weakness CWE-434 · Unrestricted file upload
Published December 4, 2023
Last update February 25, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

What the vulnerability does

01Description

The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until the device is restarted.

Key dates

02Disclosure timeline

December 4, 2023 CVE published
February 25, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-3745 Unrestricted Upload of File with Dangerous Type in flatcore/flatcore-cms CVE-2024-50529 WordPress Training – Courses plugin <= 2.0.1 - Arbitrary File Upload vulnerability CVE-2025-5171 llisoft MTA Maita Training System OpenController.java this.fileService.download unrestricted upload CVE-2023-51409 WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability CVE-2025-14849 Advantech WebAccess/SCADA Unrestricted Upload of File with Dangerous Type