PT-2023-7583 · Aleos · Aleos
CVE-2023-40464
·
Publicado
2023-08-14
·
Atualizado
2023-12-08
CVSS v2.0
8.5
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
ALEOS versions 4.16.0 and earlier
Description
The issue is related to the use of a hardcoded SSL certificate and private key in several versions of ALEOS. This could allow an attacker with access to these items to perform a man-in-the-middle attack between the ACEManager client and ACEManager server. The vulnerability is associated with weaknesses in SSL certificate verification, which could enable a remote attacker to implement a man-in-the-middle attack.
Recommendations
For ALEOS version 4.16.0 and earlier, consider disabling the use of the hardcoded SSL certificate and private key as a temporary workaround until a patch is available. Restrict access to the ACEManager client and server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Using Hardcoded Credentials
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Aleos