CVE-2021-38289
An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts. NOTE: As of April 2026, the vendor has officially decommissioned the affected legacy endpoints and associated services. The vulnerability is mitigated as the functional logic is no longer operational and the URLs have been removed from production.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.47% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Affected
- novastar/novaicare
- Source
- cve@mitre.org
References
- https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-EscalationExploit, Third Party Advisory
- https://security.novaicare.com/advisory-cve-2021-38289.html
- https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5OKSQJRQExploit, Third Party Advisory
- https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-EscalationExploit, Third Party Advisory
- https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5OKSQJRQExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.