CVE-2023-40460: Sierra Wireless ALEOS

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until the device is restarted.

Affected products

• Sierra Wireless ALEOS: up to and including 4.16.0

Published 2023-12-04. Last modified 2026-06-17.