https://vulnogram.org/ Most recent CVEs assigned by swi (swi). https://vulnogram.org/seaview/icons/swi.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2025-14859 https://vulnogram.org/CVE-2025-14859 The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a non-standard cryptographic hashing algorithm that is vulnerable to second preimage attacks.… High Tue, 07 Apr 2026 19:58:41 GMT https://vulnogram.org/CVE-2025-14858 https://vulnogram.org/CVE-2025-14858 The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware validation functionality. When a host issues a firmware validity check command via the SPI interface, the device… Medium Tue, 07 Apr 2026 19:57:43 GMT https://vulnogram.org/CVE-2025-14857 https://vulnogram.org/CVE-2025-14857 An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call sta… Medium Tue, 07 Apr 2026 19:56:59 GMT https://vulnogram.org/CVE-2023-31280 https://vulnogram.org/CVE-2023-31280 An AirVantage online Warranty Checker tool vulnerability could allow an attacker to perform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial Number in addition to th… Medium Network Exploitable Fri, 20 Dec 2024 23:41:22 GMT https://vulnogram.org/CVE-2023-31279 https://vulnogram.org/CVE-2023-31279 The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform when the owner has not disabled the AirVantage Management Service on the devices or registered the device. This c… High Fri, 20 Dec 2024 23:35:29 GMT https://vulnogram.org/CVE-2020-13712 https://vulnogram.org/CVE-2020-13712 A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.15.1 or earlier is affected. MG90 running MGOS 4.2.1 or earlier is affected. High Fri, 20 Dec 2024 21:37:35 GMT https://vulnogram.org/CVE-2023-40465 https://vulnogram.org/CVE-2023-40465 Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local area network, resulting in a Denial of Service condition for the captive portal. High Mon, 04 Dec 2023 23:02:04 GMT https://vulnogram.org/CVE-2023-40464 https://vulnogram.org/CVE-2023-40464 Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items could potentially perform a man in the middle attack between the ACEManager client and ACEManager server. High Mon, 04 Dec 2023 22:59:33 GMT https://vulnogram.org/CVE-2023-40463 https://vulnogram.org/CVE-2023-40463 When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the common root password for that version in a directory accessible to a user with root privileges or equivalen… High Network Exploitable Mon, 04 Dec 2023 22:57:41 GMT https://vulnogram.org/CVE-2023-40462 https://vulnogram.org/CVE-2023-40462 The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. ACEManager re… High Network Exploitable Mon, 04 Dec 2023 22:53:59 GMT https://vulnogram.org/CVE-2023-40461 https://vulnogram.org/CVE-2023-40461 The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload field which does not fully validate the file name, creating a Stored Cross-Site Scripting condition. High Mon, 04 Dec 2023 22:52:13 GMT https://vulnogram.org/CVE-2023-40460 https://vulnogram.org/CVE-2023-40460 The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until… High Mon, 04 Dec 2023 22:50:04 GMT https://vulnogram.org/CVE-2023-40459 https://vulnogram.org/CVE-2023-40459 The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager without impairing other router functions. AC… High Network Exploitable Mon, 04 Dec 2023 22:48:05 GMT https://vulnogram.org/CVE-2023-40458 https://vulnogram.org/CVE-2023-40458 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a Denial of Service (DoS) condition for ACEManager without impairing other router functions. This… High Network Exploitable Wed, 29 Nov 2023 22:58:21 GMT https://vulnogram.org/CVE-2022-46650 https://vulnogram.org/CVE-2022-46650 Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page. Medium Fri, 10 Feb 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-46649 https://vulnogram.org/CVE-2022-46649 Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary shell commands on the device. High Fri, 10 Feb 2023 00:00:00 GMT