Vulnerability Description
An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts. NOTE: As of April 2026, the vendor has officially decommissioned the affected legacy endpoints and associated services. The vulnerability is mitigated as the functional logic is no longer operational and the URLs have been removed from production.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Novastar | Novaicare | 7.16.0 |
Related Weaknesses (CWE)
References
- https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-EscalationExploitThird Party Advisory
- https://security.novaicare.com/advisory-cve-2021-38289.html
- https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5ExploitThird Party Advisory
- https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-EscalationExploitThird Party Advisory
- https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5ExploitThird Party Advisory
FAQ
What is CVE-2021-38289?
CVE-2021-38289 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users,...
How severe is CVE-2021-38289?
CVE-2021-38289 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-38289?
Check the references section above for vendor advisories and patch information. Affected products include: Novastar Novaicare.