Baicells Nova 430H
CISA says Baicells Nova 430H eNodeB can be crashed by a nearby malformed uplink message.
CISA advisory ICSA-26-272-04 describes CVE-2026-96274 in Baicells Nova 430H eNodeB model pBS3101SH running BaiBLQ_3.0.12 and earlier. An unauthenticated device within radio range can send a malformed uplink with an invalid NAS payload during connection setup. The eNodeB forwards it to the core, which can drop the cell signaling association and cause a temporary outage. CISA scores it CVSS 7.4, says it is not remotely exploitable, and reports no known public exploitation.
- Affects Nova 430H eNodeB pBS3101SH through BaiBLQ_3.0.12.
- CVE-2026-96274 is an uncaught exception scored CVSS 7.4.
- A nearby device can send a malformed NAS payload during setup.
- The cell signaling association can shut down until reconnection.
- CISA says it is not remote and reports no known exploitation.
- CVEs
- CVE-2026-96274
- Vendors
- Baicells Technologies
- Products
- Nova 430H
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-96274 | Radio-range signaling DoS in Baicells Nova 430H | 8.3 | — |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to inject malformed messages which may lead to a denial-of-service condition. The following versions of Baicells Nova 430H are affected: Nova 430H eNodeB (model pBS3101SH) <=BaiBLQ_3. 0.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.