CVE-2023-0776

Remote Code Execution in Baicells QRTB Platform

State: Published
Severity: 8.1 High
Published: Feb 10, 2023
Updated: Mar 24, 2025
Reserved: Feb 10, 2023

Description

Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L	Baicells

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Nova 436QBaicells	2.12.7 and earlierAffectedfrom 2.12.8Not affected
Nova 430EBaicells	2.12.7 and earlierAffectedfrom 2.12.8Not affected
Nova 430IBaicells	2.12.7 and earlierAffectedfrom 2.12.8Not affected
Neutrino 430Baicells	2.12.7 and earlierAffectedfrom 2.12.8Not affected

References

https://baicells.com/Service/Firmware

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.