CVE-2023-0776highCWE-79

CVE-2023-0776: high-severity vulnerability in Baicells Nova 436Q

Remote Code Execution in Baicells QRTB Platform

Published · Updated

Follow this CVE+ Monitor Nova+ Monitor Neutrino

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 1.2%
Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. 
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L
Affected products
Baicells · Neutrino 430Baicells · Nova 430EBaicells · Nova 430IBaicells · Nova 436Q