Skip to content
Fencer Vulns
high 8.1

CVE-2023-0776 json

Remote Code Execution in Baicells QRTB Platform

published 2023-02-10 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-12793

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce.

Patch / fix

  • Baicells Nova 436Q 2.12.8
  • Baicells Nova 430E 2.12.8
  • Baicells Nova 430I 2.12.8
  • Baicells Neutrino 430 2.12.8

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-061-02 updated cvss 9.8

Baicells Nova

  • Baicells Technologies Neutrino 430 <=QRTB_2.12.7 Baicells Technologies Nova 430E <=QRTB_2.12.7 Baicells Technologies Nova 430I <=QRTB_2.12.7 Baicells Technologies Nova 436Q <=QRTB_2.12.7
    affected: mitigation “Baicells published a security vulnerability notice for this issue.” community.na.baicells.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L
NVD 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Baicells Nova 436Q
  • Baicells Nova 430E
  • Baicells Nova 430I
  • Baicells Neutrino 430

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.