CVEvulnerability
CVE-2021-38289
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-07-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-732
Description
An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts. NOTE: As of April 2026, the vendor has officially decommissioned the affected legacy endpoints and associated services. The vulnerability is mitigated as the functional logic is no longer operational and the URLs have been removed from production.
Affected configurations
• novastar novaicare 7.16.0
Related
Weakness · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness
References
- https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-Escalation Exploit, Third Party Advisory
- https://security.novaicare.com/advisory-cve-2021-38289.html security.novaicare.com
- https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5OKSQJRQ Exploit, Third Party Advisory
- https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-Escalation Exploit, Third Party Advisory
- https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5OKSQJRQ Exploit, Third Party Advisory