CVE-2021-38289

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-12 · updated 2026-06-17
Weakness: CWE-732

Description

An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts. NOTE: As of April 2026, the vendor has officially decommissioned the affected legacy endpoints and associated services. The vulnerability is mitigated as the functional logic is no longer operational and the URLs have been removed from production.

Affected products

Novastar Novaicare: 7.16.0

References

https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-Escalation
https://security.novaicare.com/advisory-cve-2021-38289.html
https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5OKSQJRQ
https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-Escalation
https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5OKSQJRQ

Get alerted when CVE-2021-38289 or the next vulnerability affects your stack