CVE-2023-40463 - CVE House
Back to Database
Status published High CVE-2023-40463

Use of Hard-Coded Credentials

Vulnerability Description

When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalent access.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40463

Credits & Attribution

No credits recorded in the NVD database.

References

More from SierraWireless

View All →
CVE-2023-40465
Improper input leads to DoS
High 8.3
CVE-2023-40464
Use of hardcoded certificate and private key
High 8.1
CVE-2023-40462
Improper input leads to DoS
High 7.5
CVE-2023-40461
Cross-site scripting vulnerability in ACEManager
High 8.1
CVE-2023-40460
Improper input leads to DoS
High 7.1

Affected Vendor

SierraWireless

View all reports →

Affected Software

ALEOS
Vulnerable Versions:
4.10, 0

Timeline

Official Publish: December 4th, 2023
Last Modified: May 29th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-798

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access
T1098 Account Manipulation
Privilege Escalation