CVE-2023-24215 Overview
CVE-2023-24215 is an incorrect access control vulnerability in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16. Unauthenticated remote attackers can issue a crafted POST request to retrieve administrator credentials directly from the device. The flaw is classified under [CWE-284] Improper Access Control and requires no authentication, user interaction, or local access. Successful exploitation yields full administrative control of the affected cellular router, enabling network pivoting, traffic interception, and persistent device compromise.
Critical Impact
Unauthenticated attackers reachable on the network can extract administrator credentials from AirGate 4G routers via a single HTTP POST request.
Affected Products
- NOVUS AirGate 4G router firmware version v1.1.16
- AirGate 4G cellular gateway devices running the vulnerable web management interface
- Deployments exposing the /uci/get/ endpoint to untrusted networks
Discovery Timeline
- 2026-05-18 - CVE-2023-24215 published to the National Vulnerability Database
- 2026-05-19 - Last updated in NVD database
Technical Details for CVE-2023-24215
Vulnerability Analysis
The AirGate 4G web management interface exposes a /uci/get/ endpoint that interacts with the device's Unified Configuration Interface (UCI). UCI is the configuration subsystem common to OpenWrt-derived embedded firmware. The endpoint returns configuration values stored in UCI namespaces, including credentials used by the administrative account.
The vulnerable handler does not enforce authentication or session validation before processing requests. An attacker who reaches the device over the network can send a crafted POST request and receive sensitive configuration data in the response. The returned payload includes the administrator username and password, allowing the attacker to log in to the management interface as a legitimate operator.
With administrator access, an attacker can modify routing rules, alter DNS settings, enable remote shell access, install persistent firmware modifications, and intercept or redirect cellular traffic transiting the device.
Root Cause
The root cause is a missing authorization check on the /uci/get/ HTTP handler. Sensitive configuration namespaces should be restricted to authenticated administrative sessions, but the firmware returns these values to any caller. The design fails to separate public status endpoints from privileged configuration reads.
Attack Vector
Exploitation is remote and network-based. The attacker needs only network reachability to the device's HTTP management service. No credentials, social engineering, or prior foothold are required. The disclosure published on the GitHub CVE-2023-24215 Disclosure page documents the crafted POST request structure used to retrieve credentials from the UCI endpoint.
See the public disclosure for the exact request payload and proof-of-concept details:
https://github.com/sql3t0/cve-disclosures/blob/main/00_-_CVE-2023-24215.md
Detection Methods for CVE-2023-24215
Indicators of Compromise
- Unauthenticated HTTP POST requests targeting the /uci/get/ path on AirGate 4G devices
- Unexpected administrator logins from external IP addresses following access to /uci/get/
- Configuration changes to routing, DNS, firewall, or remote access settings without an approved change record
- New or unfamiliar accounts, SSH keys, or scheduled tasks present on the device
Detection Strategies
- Inspect web server and reverse proxy logs for POST requests to /uci/get/ originating from non-management subnets
- Correlate access to the /uci/get/ endpoint with subsequent successful administrator authentications from the same source IP
- Monitor for repeated probing of UCI-related URIs across AirGate 4G fleets, which indicates automated credential harvesting
Monitoring Recommendations
- Forward router HTTP and authentication logs to a centralized log platform for correlation and retention
- Alert on any external source IP reaching the device management interface on TCP 80 or 443
- Baseline the device configuration and trigger alerts when UCI values diverge from the approved state
How to Mitigate CVE-2023-24215
Immediate Actions Required
- Restrict the AirGate 4G web management interface to trusted management VLANs and block WAN-side access
- Rotate the administrator password on every AirGate 4G device after isolating management access
- Audit recent device configurations for unauthorized changes to routing, DNS, firewall, or remote access settings
- Contact NOVUS through the Novus Homepage and the Airgate Homepage for firmware updates beyond v1.1.16
Patch Information
No vendor patch is referenced in the NVD entry for firmware versions later than v1.1.16 at the time of publication. Operators should consult NOVUS support channels for an updated firmware image addressing the missing authorization check on /uci/get/. Until a fix is available, network-layer controls are the primary defense.
Workarounds
- Place AirGate 4G devices behind a firewall that allows management access only from a dedicated jump host or administrative subnet
- Disable remote HTTP and HTTPS management on the WAN interface and require VPN access for configuration tasks
- Apply ACLs on upstream networking equipment to drop inbound traffic to TCP 80 and 443 destined for AirGate 4G devices
# Example iptables rule to restrict management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
