PT-2023-7583 · Aleos · Aleos
Published
2023-08-14
·
Updated
2023-12-08
·
CVE-2023-40464
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
ALEOS versions 4.16.0 and earlier
Description
The issue is related to the use of a hardcoded SSL certificate and private key in several versions of ALEOS. This could allow an attacker with access to these items to perform a man-in-the-middle attack between the ACEManager client and ACEManager server. The vulnerability is associated with weaknesses in SSL certificate verification, which could enable a remote attacker to implement a man-in-the-middle attack.
Recommendations
For ALEOS version 4.16.0 and earlier, consider disabling the use of the hardcoded SSL certificate and private key as a temporary workaround until a patch is available. Restrict access to the ACEManager client and server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Using Hardcoded Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Aleos