Unrated severityNVD Advisory· Published Jan 24, 2023· Updated Apr 2, 2025

Hard Coded Credential Crypt Vulnerability

CVE-2023-24022

Description

Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)

Affected products

Baicells/Nova 227llm-create2 versions
<=3.7.11.3+ 1 more
- (no CPE)range: <=3.7.11.3
- (no CPE)range: 0
Baicells/Nova 233llm-create2 versions
<=3.7.11.3+ 1 more
- (no CPE)range: <=3.7.11.3
- (no CPE)range: 0
Baicells/Nova 246llm-fuzzy2 versions
<=3.7.11.3+ 1 more
- (no CPE)range: <=3.7.11.3
- (no CPE)range: 0

Patches

Vulnerability mechanics

References

img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6.IMG.IMGmitrepatch
baicells.zendesk.com/hc/en-us/articles/6188324645780-2023-1-17-Hard-Coded-Credential-Crypt-Vulnerabilitymitrevendor-advisory
img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6_Changelog.PDF.pdfmitrerelease-notes

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000