CVE-2023-40460CWE-434CWE-79

Improper input leads to DoS

High · published December 4, 2023

CVSS v3.1
7.1
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

The ACEManager

component of ALEOS 4.16 and earlier does not

validate uploaded

file names and types, which could potentially allow

an authenticated

user to perform client-side script execution within

ACEManager, altering

the device functionality until the device is

restarted.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00495 · 41.6th percentile
Weaknesses
CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-12-04T22:50Z
EPSS history
Timeline
  • 04 DEC 22:50Z
    Improper input leads to DoS
    cvelistv5