Critical · 9.1 CVE-2023-24215 EUVD-2023-28274GHSA-fhqm-w73x-978p

Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administ…

Published May 18, 2026 · Updated Jul 5, 2026 · Assigned by mitre

Description

Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials via a crafted POST request.

References

https://github.com/sql3t0/cve-disclosures/blob/main/00_-_CVE-2023-24215.md