CVE-2023-24022

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Jan 26, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-240236.8Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow cerCVE-2023-240257.5CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forgeries of digital signaCVE-2023-240266.1In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.CVE-2023-240276.1In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.CVE-2023-240289.8In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.CVE-2023-240297.2In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface dCVE-2023-240306.1An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerabiCVE-2023-240316.1An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to eCVE-2023-240327.8In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commCVE-2023-240339.8The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly checCVE-2023-240343.1An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by usinCVE-2023-240353.5An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads