Skip to content
OpenAdvisories

Vendor

Baicells

15 known vulnerabilities.

Products

NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846 3 NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOVA246, NOVA243, NOVA233, NOVA227 2 Nova 227 2 Nova 233 2 EG3661M 1 Nova 430H eNodeB (model pBS3101SH) 1 EG7035-M11 1 Nova 436Q 1 Nova 430E 1 Nova 430I 1 Neutrino 430 1 Snap Router 1 NEUTRINO430 1 SPECTRA LTE-U eNB 1 EG7035E-M11 1 Nova 246 1 Nova 243 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.4
    CVE-2026-96274

    Uncaught exception in Baicells Nova 430H

    In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the co…

    Baicells Nova 430H eNodeB (model pBS3101SH)
  • High 7.2
    CVE-2026-19771

    Baicells EG3661M LuCI Web luci os command injection

    A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The …

    Baicells EG3661M
  • High 8.4
    CVE-2025-55047

    CWE-798 Use of Hard-coded Credentials

    Baicells SPECTRA LTE-U eNB
  • High 8.1
    CVE-2023-0776

    Remote Code Execution in Baicells QRTB Platform

    Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with…

    Baicells Neutrino 430 Nova 436Q Nova 430I
  • High 8.1
    CVE-2023-24508

    Remote Code Execution in Baicells RTS Platform

    Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with r…

    Baicells Nova 227 Nova 233 Nova 246