Skip to main content
Public proof of concept

CVE-2022-46649

A public proof of concept exists; no exploitation attested.

  • Published2023-02-10
  • WeaknessCWE-78

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device.

Timeline

dates in UTC
  1. 2023-02-1018:15CVE publishedNVD

Versions per branch

NVD
Sierrawireless aleosversion to verify
BranchAffectedFixed in
4.9≤ 4.9.7no fix published
4.16≤ 4.16.0no fix published

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Products declared by the CNA1 product

As SWI, the CNA that assigned this CVE, declared them in the CVE record; versions as written.

  • ALEOS
    Affected
    • = all versions before 4.16no fix stated

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2023-02-10

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

  • ICSA-23-026-04 CISA2 known affected

    Sierra Wireless AirLink Router with ALEOS Software

    AirLink Router with ALEOS Software: Airlink Router (ES450, GX450) running ALEOS software: Versions 4.9.7 and prior · AirLink Router with ALEOS Software: Airlink Router (MP70, RV50, RV50x, RV55, LX 40, LX60) running ALEOS software: Versions prior to 4.16.0

Full record on NVD

Fix

  1. Mitigation from the vendor CISA ICSA-23-026-04 · 2 productsUpgrade MP70, RV50, RV50x, RV55, LX 40, LX60 to ALEOS version 4.16.0 or later
  2. Mitigation from the vendor CISA ICSA-23-026-04 · 2 productsUpgrade ES450, GX450 to ALEOS version 4.9.8 (when available) or later
  3. Mitigation from the vendor CISA ICSA-23-026-04 · 2 productsAlways use strong, and ideally unique random credentials for devices. ALEOS devices ship with unique random credentials by default.
  4. Mitigation from the vendor CISA ICSA-23-026-04 · 2 productsDisable access to ACEManager on the wide area network (WAN) and use the Sierra Wireless Airlink Management System (ALMS) or an alternative device management platform for remote management of ALEOS devices.
  5. Mitigation from the vendor CISA ICSA-23-026-04 · 2 productsIf the ACEManager must remain accessible via the WAN, restrict access using measures such as Private APN, VPN, or the ALEOS Trusted IP feature (restricts access to specific hosts).

Advisories and patches

Detection

read 2026-11-01 01:02 UTC
Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof of concept
Metasploit modules
none listed
Metasploit Framework

Sources

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
2023-02-10
Last Modified
2026-06-17
NVD status
Modified
GitHub Advisory
GHSA-cxpc-g33f-3fqv

Frequently asked questions

What is CVE-2022-46649?

Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device.

Is CVE-2022-46649 actively exploited?

A proof-of-concept exploit exists for CVE-2022-46649, but active exploitation has not been confirmed at this time.

What is the CVSS score for CVE-2022-46649?

CVE-2022-46649 has a CVSS v3 base score of 8.8 (HIGH severity), with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Hear about the next vulnerability in your software

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record