CVE-2023-40463 Vulnerability Details

  /     /     /  

CVE-2023-40463 Metadata Quick Info

CVE Published: 04/12/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: SWI | Vendor: SierraWireless | Product: ALEOS
Status : PUBLISHED

---

CVE-2023-40463 Description

When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalent access.

Metrics

CVSS Version: 3.1 | Base Score: 8.1 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-798
CWE Name: CWE-798 Use of Hard-coded Credentials
Source: SierraWireless

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-191
CAPEC Description: CAPEC-191 Read Sensitive Strings Within an Executable


Source: NVD (National Vulnerability Database).