CVE-2023-24508

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-24508
Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. 

9.6 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6.IMG.IMG Release Notes Vendor Advisory
https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6_Changelog.PDF.pdf Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:baicells:rtd_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:baicells:rts_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:baicells:nova227:-:*:*:*:*:*:*:*
cpe:2.3:h:baicells:nova233:-:*:*:*:*:*:*:*
cpe:2.3:h:baicells:nova243:-:*:*:*:*:*:*:*
cpe:2.3:h:baicells:nova246:-:*:*:*:*:*:*:*
History

07 Nov 2023, 04:08

Type Values Removed Values Added
Summary Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. 

08 Feb 2023, 21:29

Type Values Removed Values Added
References (MISC) https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6.IMG.IMG - (MISC) https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6.IMG.IMG - Release Notes, Vendor Advisory
References (MISC) https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6_Changelog.PDF.pdf - (MISC) https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6_Changelog.PDF.pdf - Release Notes, Vendor Advisory
First Time Baicells rts Firmware
Baicells nova246
Baicells rtd Firmware
Baicells nova243
Baicells nova227
Baicells
Baicells nova233
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.6
CPE cpe:2.3:h:baicells:nova243:-:*:*:*:*:*:*:*
cpe:2.3:o:baicells:rts_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:baicells:nova233:-:*:*:*:*:*:*:*
cpe:2.3:o:baicells:rtd_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:baicells:nova246:-:*:*:*:*:*:*:*
cpe:2.3:h:baicells:nova227:-:*:*:*:*:*:*:*

26 Jan 2023, 21:18

Type Values Removed Values Added
New CVE
Information

Published : 2023-01-26 21:18

Updated : 2023-12-10 14:48

NVD link : CVE-2023-24508

Mitre link : CVE-2023-24508

CVE.ORG link : CVE-2023-24508

JSON object : View

Products Affected

baicells

  • rtd_firmware
  • nova233
  • nova227
  • nova243
  • rts_firmware
  • nova246
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')