RCE in Baicells Neutrino 430
CVE-2023-0776
Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.012 (64.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@baicells.com (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-0776?
- CVE-2023-0776 is a high-severity vulnerability in Baicells Neutrino 430, classified under Cross-site Scripting. CVSS score: 8.1/10. Published 2023-02-11.
- How severe is CVE-2023-0776?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2023-0776 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.