CVE-2023-40464

Use of hardcoded certificate and private key

MEDIUM

6.8

CVSS Score

Published: December 4, 2023 at 10:59 PM UTC

Updated: June 17, 2026 at 06:17 AM UTC

8 products affected across 1 vendorALEOSGx450Rv50X

Using ALEOS by SierraWireless?

Get instant alerts when new vulnerabilities affect ALEOS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items could potentially perform a man in the middle attack between the ACEManager client and ACEManager server.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ALEOS · Sierrawireless

95%

v ≤ 4.16.0v ≤ 4.9.84.10 ≤ v ≤ 4.164.10

sierrawireless-es450 (environment) · sierrawireless-gx450 (environment) · sierrawireless-lx40 (environment) · sierrawireless-lx60 (environment) · sierrawireless-mp70 (environment) · sierrawireless-rv50x (environment) · sierrawireless-rv55 (environment)

Es450 · Sierrawirelessdevice

80%

All versions

Gx450 · Sierrawirelessdevice

80%

All versions

Lx40 · Sierrawirelessdevice

80%

All versions

Lx60 · Sierrawirelessdevice

80%

All versions