CVE-2026-96274
Uncaught exception in Baicells Nova 430H
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdown of the signaling association for the cell. This results in a temporary service disruption until the eNodeB and core network re-establish connectivity.
| CWE | CWE-248 |
| Vendor | baicells |
| Product | nova 430h enodeb (model pbs3101sh) |
| Published | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for baicells nova 430h enodeb (model pbs3101sh)
Be the first to know when new high vulnerabilities affecting baicells nova 430h enodeb (model pbs3101sh) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Baicells / Nova 430H eNodeB (model pBS3101SH)
0 ≤ BaiBLQ_3.0.12
References
Credits
Qiqing Huang reported this vulnerability to CISA.