CVE-2022-46649

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-46649", "assignerOrgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e", "assignerShortName": "SWI", "dateUpdated": "2025-03-24T16:05:39.446Z", "dateReserved": "2022-12-05T00:00:00.000Z", "datePublished": "2023-02-10T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e", "shortName": "SWI", "dateUpdated": "2023-02-10T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device."}], "affected": [{"vendor": "n/a", "product": "ALEOS", "versions": [{"version": "all versions before 4.16", "status": "affected"}]}], "references": [{"url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-001/"}, {"url": "https://www.otorio.com/blog/airlink-acemanager-vulnerabilities/"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-04"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-78 - Improper Neutralization of Special Elements used in an OS Command", "cweId": "CWE-78"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:39:38.434Z"}, "title": "CVE Program Container", "references": [{"url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-001/", "tags": ["x_transferred"]}, {"url": "https://www.otorio.com/blog/airlink-acemanager-vulnerabilities/", "tags": ["x_transferred"]}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-04", "tags": ["x_transferred"]}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-24T16:04:16.876245Z", "id": "CVE-2022-46649", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-24T16:05:39.446Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-001/", "tags": ["x_transferred"]}, {"url": "https://www.otorio.com/blog/airlink-acemanager-vulnerabilities/", "tags": ["x_transferred"]}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-04", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:39:38.434Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-46649", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-24T16:04:16.876245Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-24T16:05:29.253Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "ALEOS", "versions": [{"status": "affected", "version": "all versions before 4.16"}]}], "references": [{"url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-001/"}, {"url": "https://www.otorio.com/blog/airlink-acemanager-vulnerabilities/"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-04"}], "descriptions": [{"lang": "en", "value": "Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 - Improper Neutralization of Special Elements used in an OS Command"}]}], "providerMetadata": {"orgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e", "shortName": "SWI", "dateUpdated": "2023-02-10T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-46649", "state": "PUBLISHED", "dateUpdated": "2025-03-24T16:05:39.446Z", "dateReserved": "2022-12-05T00:00:00.000Z", "assignerOrgId": "747bec18-acd0-4d99-a5c8-5e366c66ab7e", "datePublished": "2023-02-10T00:00:00.000Z", "assignerShortName": "SWI"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "ALEOS", "vendor": "n/a", "versions": [{"status": "affected", "version": "all versions before 4.16"}]}], "source": "security@sierrawireless.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA19B9D5-D298-4910-8406-5C5059AB8626", "versionEndIncluding": "4.9.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sierrawireless:es450:-:*:*:*:*:*:*:*", "matchCriteriaId": "524DF1AE-21F2-4AA6-99E7-6F98304FF845", "vulnerable": false}, {"criteria": "cpe:2.3:h:sierrawireless:gx450:-:*:*:*:*:*:*:*", "matchCriteriaId": "2C12CF71-FE0E-44EA-9F2E-7CFB42E7C216", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*", "matchCriteriaId": "45265DDA-E10F-49D0-B2C6-FC123C42E5AE", "versionEndIncluding": "4.16.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sierrawireless:lx40:-:*:*:*:*:*:*:*", "matchCriteriaId": "069DD303-C100-4FAF-BD6B-4EE61CBDE9F7", "vulnerable": false}, {"criteria": "cpe:2.3:h:sierrawireless:lx60:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A3B7B3D-1594-434B-8E22-01C67DF54F16", "vulnerable": false}, {"criteria": "cpe:2.3:h:sierrawireless:mp70:-:*:*:*:*:*:*:*", "matchCriteriaId": "007D4629-4BE2-4C7A-AC8B-E87739E22D12", "vulnerable": false}, {"criteria": "cpe:2.3:h:sierrawireless:rv50:-:*:*:*:*:*:*:*", "matchCriteriaId": "54218BC7-D942-4907-8052-ECB308753162", "vulnerable": false}, {"criteria": "cpe:2.3:h:sierrawireless:rv50x:-:*:*:*:*:*:*:*", "matchCriteriaId": "61D3EF27-E823-4E49-BD58-D050EB02D294", "vulnerable": false}, {"criteria": "cpe:2.3:h:sierrawireless:rv55:-:*:*:*:*:*:*:*", "matchCriteriaId": "215BD4AB-8EFD-4F82-ABE4-E7F81AD528C2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device."}], "id": "CVE-2022-46649", "lastModified": "2026-06-17T05:12:07.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-46649", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-24T16:04:16.876245Z", "version": "2.0.3"}}]}, "published": "2023-02-10T18:15:13.247", "references": [{"source": "security@sierrawireless.com", "tags": ["Vendor Advisory"], "url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-001/"}, {"source": "security@sierrawireless.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-04"}, {"source": "security@sierrawireless.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.otorio.com/blog/airlink-acemanager-vulnerabilities/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-001/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.otorio.com/blog/airlink-acemanager-vulnerabilities/"}], "sourceIdentifier": "security@sierrawireless.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security@sierrawireless.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}