Which versions of Baicells EG3661M are affected by CVE-2026-19771?

Baicells EG3661M network devices running firmware BaiCE_BQ6_2.0.5.3_NA are vulnerable to command injection by users with administrative credentials, enabling complete device takeover.

Is there a public PoC exploit available for CVE-2026-19771?

Yes, a public proof-of-concept exploit is available for CVE-2026-19771. Prioritise patching immediately. EPSS: 2.8%.

How to fix or mitigate CVE-2026-19771?

Within 24 hours, identify all Baicells EG3661M devices in your environment running firmware BaiCE_BQ6_2.0.5.3_NA and immediately restrict administrative access to isolated networks with strict authentication controls and access logging enabled. Within 7 days, implement network segmentation to segregate these devices from production systems and deploy real-time monitoring for anomalous command execution patterns. Within 30 days, contact Baicells for available firmware updates, evaluate alternative network equipment vendors, and establish a timeline for device replacement if no secure firmware release is provided.

Baicells EG3661M CVE-2026-19771

Q: What is the CVSS score of CVE-2026-19771?

CVE-2026-19771 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.8%.

EUVD-2026-58564 HIGH

OS Command Injection (CWE-78)

2026-08-14 VulDB

GHSA-w9jh-6rx2-4wh5

Command Injection Eg3661M Baicells

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-accessible LuCI interface requires admin credentials (PR:H); no scope change as impact is confined to the vulnerable device (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:42 vuln.today

CVSS changed

Aug 14, 2026 - 02:22 NVD

8.6 (HIGH) 7.3 (HIGH)

CVE Published

Aug 14, 2026 - 01:45 cve.org

HIGH 7.3

DescriptionCVE.org

A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

OS command injection in the Baicells EG3661M LuCI web interface (firmware BaiCE_BQ6_2.0.5.3_NA) allows an authenticated remote attacker with administrative credentials to execute arbitrary operating system commands by manipulating the MaxHops, Timeout, or Size arguments passed to /cgi-bin/luci. Full confidentiality, integrity, and availability compromise of the device is achievable upon exploitation. A public proof-of-concept exploit is available on GitHub, and no vendor patch exists - the vendor did not respond to responsible disclosure, leaving affected deployments with no official remediation path.

Technical ContextAI

The Baicells EG3661M is a network device (likely a small cell base station or customer-premises equipment) running OpenWrt-derived firmware (BaiCE_BQ6_2.0.5.3_NA). LuCI is the standard web UI framework for OpenWrt-based devices, accessible via /cgi-bin/luci. The vulnerable parameters - MaxHops, Timeout, and Size - are characteristic of network diagnostic utilities such as ping and traceroute, where user-supplied values are passed as arguments to shell commands. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that the application fails to sanitize or escape these inputs before passing them to a shell interpreter, enabling injection of arbitrary commands. CPE cpe:2.3:a:baicells:eg3661m confirms the affected product scope. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P) confirms remote network reachability, low attack complexity, and no scope change beyond the vulnerable device itself.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure attempt. The POC is publicly available at https://github.com/actuator/cve/blob/main/Baicells/EG3661M.md and should be reviewed to understand the exact injection surface. As the primary compensating control, restrict access to the LuCI web management interface (/cgi-bin/luci) to trusted management networks only via firewall ACLs or management VLAN segmentation - this prevents remote exploitation entirely for network-unreachable interfaces, with the trade-off of reducing remote management capability. Additionally, enforce strong, unique administrative credentials on all EG3661M devices to raise the bar for PR:H exploitation; avoid shared or default credentials. Disable remote management features entirely if they are not operationally required. Monitor VulDB (https://vuldb.com/vuln/389685) and the ENISA EUVD entry EUVD-2026-58564 for any future vendor patch release.