Aleos

Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local area network, resulting in a Denial of Service condition for the captive portal.

Published: 2023-12-04T23:02:04.103Z
Updated: 2024-08-02T18:31:53.825Z

Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items could potentially perform a man in the middle attack between the ACEManager client and ACEManager server.

Published: 2023-12-04T22:59:33.449Z
Updated: 2026-02-25T17:20:06.330Z

When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalent access.

Published: 2023-12-04T22:57:41.197Z
Updated: 2025-05-29T13:43:19.838Z

The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting within ten seconds of becoming unavailable.

Published: 2023-12-04T22:53:59.402Z
Updated: 2025-02-13T17:08:24.772Z

The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload field which does not fully validate the file name, creating a Stored Cross-Site Scripting condition.

Published: 2023-12-04T22:52:13.650Z
Updated: 2026-02-25T17:20:06.671Z