CVE-2023-24508

Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. 

• CWE-79
• CWE-79

• https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6.IMG.IMGRelease Notes, Vendor Advisory
• https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6_Changelog.PDF.pdfRelease Notes, Vendor Advisory
• https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6.IMG.IMGRelease Notes, Vendor Advisory
• https://img.baicells.com//Upload/20230118/FILE/BaiBS_RTS_3.7.11.6_Changelog.PDF.pdfRelease Notes, Vendor Advisory

Published

Jan 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24502Electra Central AC unit – The unit opens an AP with an easil…6.5
• CVE-2023-24503Electra Central AC unit – Adjacent attacker may cause the un…6.5
• CVE-2023-24504Electra Central AC unit – Adjacent attacker may cause the un…6.5
• CVE-2023-24505 Milesight NCR/camera version 71.8.0.6-r5 discloses sensitiv…7.5
• CVE-2023-24506 Milesight NCR/camera version 71.8.0.6-r5 exposes credenti…7.5
• CVE-2023-24507 AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload -…9.8
• CVE-2023-24509On affected modular platforms running Arista EOS equipped wi…7.8
• CVE-2023-2451A vulnerability was found in SourceCodester Online DJ Manage…9.8
• CVE-2023-24510On the affected platforms running EOS, a malformed DHCP pack…7.5
• CVE-2023-24511On affected platforms running Arista EOS with SNMP configure…7.5
• CVE-2023-24512On affected platforms running Arista EOS, an authorized atta…6.5
• CVE-2023-24513On affected platforms running Arista CloudEOS an issue in th…7.5