CVE-2019-11856 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2019-11856

Analyzed

More Info Official Page

Source-cve@mitre.org

Published At-21 Aug, 2020 | 19:15

Updated At-09 Feb, 2022 | 19:28

A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	3.8	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Secondary	3.1	3.3	LOW	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Primary	2.0	5.5	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:P

CPE Matches

sierrawireless>>aleos>>Versions up to 4.12.0(inclusive)

cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*

sierrawireless>>airlink_lx40>>-

cpe:2.3:h:sierrawireless:airlink_lx40:-:*:*:*:*:*:*:*

sierrawireless>>airlink_lx60>>-

cpe:2.3:h:sierrawireless:airlink_lx60:-:*:*:*:*:*:*:*

sierrawireless>>airlink_mp70>>-

cpe:2.3:h:sierrawireless:airlink_mp70:-:*:*:*:*:*:*:*

sierrawireless>>airlink_mp70e>>-

cpe:2.3:h:sierrawireless:airlink_mp70e:-:*:*:*:*:*:*:*

sierrawireless>>airlink_rv50>>-

cpe:2.3:h:sierrawireless:airlink_rv50:-:*:*:*:*:*:*:*

sierrawireless>>airlink_rv50x>>-

cpe:2.3:h:sierrawireless:airlink_rv50x:-:*:*:*:*:*:*:*

sierrawireless>>aleos>>Versions up to 4.9.4(inclusive)

cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*

sierrawireless>>airlink_es450>>-

cpe:2.3:h:sierrawireless:airlink_es450:-:*:*:*:*:*:*:*

sierrawireless>>airlink_gx450>>-

cpe:2.3:h:sierrawireless:airlink_gx450:-:*:*:*:*:*:*:*

sierrawireless>>aleos>>Versions up to 4.4.8(inclusive)

cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*

sierrawireless>>airlink_es440>>-

cpe:2.3:h:sierrawireless:airlink_es440:-:*:*:*:*:*:*:*

sierrawireless>>airlink_gx400>>-

cpe:2.3:h:sierrawireless:airlink_gx400:-:*:*:*:*:*:*:*

sierrawireless>>airlink_gx440>>-

cpe:2.3:h:sierrawireless:airlink_gx440:-:*:*:*:*:*:*:*

sierrawireless>>airlink_ls300>>-

cpe:2.3:h:sierrawireless:airlink_ls300:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-294	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-004/	cve@mitre.org	Vendor Advisory