« Volver al listado

CVE-2023-24022

Estado: ModificadaCrítica (9.8)—

Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Baicells — RTD FirmwareBaicells — RTS Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-24022",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-24022",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-02T13:35:16.997346Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@baicells.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@baicells.com",
      "affectedData": [
        {
          "vendor": "Baicells",
          "product": "Nova 227",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.7.11.6",
                  "status": "unaffected"
                }
              ],
              "version": "0",
              "versionType": "patch",
              "lessThanOrEqual": "3.7.11.3"
            }
          ],
          "platforms": [
            "RTS"
          ],
          "packageName": "3.7.11.3",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Baicells",
          "product": "Nova 233",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.7.11.6",
                  "status": "unaffected"
                }
              ],
              "version": "0",
              "versionType": "patch",
              "lessThanOrEqual": "3.7.11.3"
            }
          ],
          "platforms": [
            "RTS"
          ],
          "packageName": "3.7.11.3",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Baicells",
          "product": "Nova 243",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.7.11.6 ",
                  "status": "unaffected"
                }
              ],
              "version": "0",
              "versionType": "patch",
              "lessThanOrEqual": "3.7.11.3"
            }
          ],
          "platforms": [
            "RTS"
          ],
          "packageName": "3.7.11.3",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-01-26T21:18:15.593",
  "references": [
    {
      "url": "https://baicells.zendesk.com/hc/en-us/articles/6188324645780-2023-1-17-Hard-Coded-Credential-Crypt-Vulnerability",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@baicells.com"
    },
    {
      "url": "https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6.IMG.IMG",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security@baicells.com"
    },
    {
      "url": "https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6_Changelog.PDF.pdf",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security@baicells.com"
    },
    {
      "url": "https://baicells.zendesk.com/hc/en-us/articles/6188324645780-2023-1-17-Hard-Coded-Credential-Crypt-Vulnerability",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6.IMG.IMG",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6_Changelog.PDF.pdf",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@baicells.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.) \n"
    },
    {
      "lang": "es",
      "value": "Los dispositivos Baicells Nova 227, Nova 233 y Nova 243 LTE TDD eNodeB con firmware hasta RTS/RTD 3.7.11.3 tienen credenciales codificadas que se descubren fácilmente y pueden ser utilizadas por atacantes remotos para autenticarse a través de ssh. (Las credenciales se almacenan en el firmware, cifradas mediante la función de cripta)."
    }
  ],
  "lastModified": "2026-06-17T05:38:29.690",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:baicells:rtd_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "148B43F9-03E6-43FC-9631-94EAFB4497FB",
              "versionEndExcluding": "3.7.11.6"
            },
            {
              "criteria": "cpe:2.3:o:baicells:rts_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB305C49-EC84-4C16-B961-1DAA3BC6B108",
              "versionEndExcluding": "3.7.11.6"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:baicells:nova227:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2FF244C0-5EC5-41ED-8474-23097129A903"
            },
            {
              "criteria": "cpe:2.3:h:baicells:nova233:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E9943901-505F-495E-8B83-B6D50E2ECD26"
            },
            {
              "criteria": "cpe:2.3:h:baicells:nova243:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B3A7D0D1-2ADE-4EB6-B2C4-060528D60598"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@baicells.com"
}