CVE-2023-24215

CriticalCVSS 9.1/10Last modified Jul 5, 2026

Description

Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials via a crafted POST request.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
May 18, 2026
Last modified
Jul 5, 2026
NVD status
Awaiting Analysis

Related CVEs from 2023

CVE-2023-242178.8AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.CVE-2023-242199.8LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml.CVE-2023-24227.1A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify CVE-2023-242209.8LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml.CVE-2023-242219.8LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml.CVE-2023-242297.8DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system cCVE-2023-24237.5A vulnerability was discovered in the Rockwell Automation Armor PowerFlex device when the product sends communications to the local event loCVE-2023-242304.8A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to executeCVE-2023-242314.8A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management SCVE-2023-242324.8A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management SystCVE-2023-242334.8A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory ManagementCVE-2023-242344.8A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System