What is CVE-2023-1097?

CVE-2023-1097 is a critical-severity vulnerability in Baicells Eg7035-M11, classified under Code Injection. CVSS score: 9.3/10. Published 2023-03-01.

How severe is CVE-2023-1097?

Critical severity. CVSS v3 base score is 9.3 out of 10.

RCE in Baicells Eg7035-M11

CVE-2023-1097

Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party analyst and have been confirmed exploitable special thanks to Lionel Musonza for the discovery.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.011 (63.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Baicells Eg7035-m11 — versions 0
Baicells Eg7035-m11_firmware

Weakness classification (CWE)

References

security@baicells.com (release-notes, Release Notes, patch)
security@baicells.com (Product, patch)

Frequently asked questions

What is CVE-2023-1097?: CVE-2023-1097 is a critical-severity vulnerability in Baicells Eg7035-M11, classified under Code Injection. CVSS score: 9.3/10. Published 2023-03-01.
How severe is CVE-2023-1097?: Critical severity. CVSS v3 base score is 9.3 out of 10.