CVE-2026-96274

The Baicells Nova 430H eNodeB does not properly validate NAS payloads in uplink messages received during connection setup. An unauthenticated device within radio range can send a malformed uplink message containing an invalid NAS payload; the base station forwards it to the core network, which can shut down the signaling association for the cell. The result is a temporary service outage until the eNodeB and core re-establish connectivity, with no confidentiality or integrity impact described. Operators of deployed Nova 430H units are affected; the advisory does not name firmware versions. No public proof-of-concept is known, and the CVE is not listed in CISA KEV.

What to do: Check the ICS-CERT advisory and Baicells guidance for a firmware fix for the Nova 430H; no patched version is named in the CVE data, so do not assume a release is already available. Until a fix is applied, watch for unexplained cell signaling drops, confirm the eNodeB and core can re-establish the association quickly, and limit unauthorized radios near the site where operations allow.