baicells vulnerabilities

Products

• NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846 3
• neutrino 430 firmware 2
• NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOVA246, NOVA243, NOVA233, NOVA227 2
• Nova 227 2
• Nova 233 2
• nova436q firmware 2
• rtd firmware 2
• rts firmware 2
• eg3661m 1
• EG7035-M11 1
• eg7035-m11 firmware 1
• EG7035E-M11 1
• ep3011 firmware 1
• Neutrino 430 1
• NEUTRINO430 1
• Nova 243 1
• Nova 246 1
• Nova 430E 1
• Nova 430H eNodeB (model pBS3101SH) 1
• Nova 430I 1
• Nova 436Q 1
• nova430e firmware 1
• nova430l firmware 1
• Snap Router 1
• SPECTRA LTE-U eNB 1

Latest baicells CVEs

Newest publication first

1. CVE-2026-96274 Uncaught exception in Baicells Nova 430H

   Published 2026-09-29

   High·CVSS 8.3 EPSS 0.16%

   In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can...

2. CVE-2026-19771 Baicells EG3661M LuCI Web luci os command injection

   Published 2026-08-14

   High·CVSS 8.6 EPSS 3.7%

   A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launche...

3. CVE-2025-55054 CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

   Published 2025-09-09

   Medium·CVSS 6.1 EPSS 0.19%

   CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

4. CVE-2025-55053 CWE-328: Use of Weak Hash

   Published 2025-09-09

   Medium·CVSS 6.5 EPSS 0.25%

   CWE-328: Use of Weak Hash

5. CVE-2025-55052 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

   Published 2025-09-09

   Medium·CVSS 4.3 EPSS 0.29%

   CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

6. CVE-2025-55051 CWE-1392: Use of Default Credentials

   Published 2025-09-09

   Critical·CVSS 10.0 EPSS 0.34%

   CWE-1392: Use of Default Credentials

7. CVE-2025-55050 CWE-1242: Inclusion of Undocumented Features

   Published 2025-09-09

   Critical·CVSS 9.8 EPSS 0.34%

   CWE-1242: Inclusion of Undocumented Features

8. CVE-2025-55049 Use of Default Cryptographic Key (CWE-1394)

   Published 2025-09-09

   Critical·CVSS 9.1 EPSS 0.30%

   Use of Default Cryptographic Key (CWE-1394)

9. CVE-2025-55048 Multiple CWE-78

   Published 2025-09-09

   Critical·CVSS 9.8 EPSS 0.56%

   Multiple CWE-78

10. CVE-2025-55047 CWE-798 Use of Hard-coded Credentials

    Published 2025-09-09

    High·CVSS 8.4 EPSS 0.14%

    CWE-798 Use of Hard-coded Credentials

11. CVE-2023-6198 Hard Coded Credential

    Published 2024-06-25

    Critical·CVSS 9.3 EPSS 0.36%

    Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access to the device.

12. CVE-2023-1097 Unauthenticated Command Injection EG7035-M11 Series

    Published 2023-03-01

    Critical·CVSS 9.8 EPSS 1.1%

    Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated b...

13. CVE-2023-0776 Remote Code Execution in Baicells QRTB Platform

    Published 2023-02-10

    Critical·CVSS 10.0 EPSS 1.2%

    Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. Th...

14. CVE-2023-24508 Remote Code Execution in Baicells RTS Platform

    Published 2023-01-24

    Critical·CVSS 9.6 EPSS 1.7%

    Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The...

15. CVE-2023-24022 Hard Coded Credential Crypt Vulnerability

    Published 2023-01-24

    Critical·CVSS 9.8 EPSS 1.6%

    Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the...

16. CVE-2022-24693 Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The cre...

    Published 2022-03-30

    Critical·CVSS 9.8 EPSS 3.3%

    Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.