PatchTheCVECVE-2023-24508: Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.
CVE-2023-24508 is a high-severity flaw (CVSS 8.1) affecting rtd firmware, rts firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.6% (top 24%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2023-01-26 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-24508?
rtd firmware: upgrade to 3.7.11.6; rts firmware: upgrade to 3.7.11.6. Exact commands for each OS are on this page.
Is CVE-2023-24508 being exploited?
CVE-2023-24508 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-24508 affect?
CVE-2023-24508 affects rtd firmware, rts firmware. Severity is high (CVSS 8.1). Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution
How urgent is CVE-2023-24508?
Priority 52/100. High severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-24022 CRITICAL 10.0 UPGRADE UPGRADE Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have h