Baicells vulnerabilities
We track 8 vulnerabilities in Baicells products across 20 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2026.
Latest Baicells vulnerabilities
- 7.4 High severity
Nova 430H eNodeB (model pBS3101SH): Uncaught Exception
In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the cor
- 7.2 High severity
EG3661M: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The a
- 9.3 Critical severity
Snap Router: Use of Hard-coded Credentials
Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access to the device.
- 9.8 Critical severity
EG7035-M11: Improper Neutralization of Special Elements used in a Command
Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been te
- 10.0 Critical severity
Nova 436Q: Improper Neutralization of Special Elements used in a Command
Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with
- 9.6 Critical severity
Nova 227: Improper Neutralization of Input During Web Page Generation
Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with ro
- 9.8 Critical severity
Nova 227: Use of Hard-coded Credentials
Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmwa
- 9.8 Critical severity
Nova436q Firmware: Use of Hard-coded Credentials
Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt