CVE-2023-40459

HIGH

Sierra Wireless ALEOS < 4.16.0 - Denial of Service in ACEManager

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2023-40459. PoCs published by majidmc2, 7h3w4lk3r.

AI-analyzed exploit summary The PoC demonstrates a DoS vulnerability in Sierra Wireless ALEOS 4.16 and earlier by sending a malformed XML request to the ACEManager endpoint, causing service disruption. The script continuously sends the crafted request to the target device.

Description

The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting within ten seconds of becoming unavailable.

Exploits (2)

nomisec WORKING POC 4 stars
by majidmc2 · poc
https://github.com/majidmc2/CVE-2023-40459

The PoC demonstrates a DoS vulnerability in Sierra Wireless ALEOS 4.16 and earlier by sending a malformed XML request to the ACEManager endpoint, causing service disruption. The script continuously sends the crafted request to the target device.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Sierra Wireless ALEOS 4.16 and earlier
No auth needed
Prerequisites: Network access to the target device · ACEManager service exposed on port 9091
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by 7h3w4lk3r · poc
https://github.com/7h3w4lk3r/CVE-2023-40459

This repository contains a functional Python script that exploits CVE-2023-40459, an unauthenticated DoS vulnerability in Sierra Wireless ACEManager (ALEOS 4.16 and earlier). The script sends repeated XML requests to trigger the DoS condition.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Sierra Wireless ACEManager (ALEOS 4.16 and earlier)
No auth needed
Prerequisites: Network access to the target ACEManager interface · Target running vulnerable ALEOS version
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0230
EPSS Percentile 81.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (1)
sierrawireless/aleos < 4.16.0
Published Dec 04, 2023
Tracked Since Feb 18, 2026