EUVD-2026-89358
GHSA-r2c9-ccv7-wg9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition radio within cell range
-
DeliverySend malformed connection-setup uplink
-
ExploitInvalid NAS payload passes eNodeB validation
-
ExecutioneNodeB forwards to core network
-
PersistCore shuts down signaling association
-
ImpactCell service disrupted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Exploitation requires RF/radio-frequency proximity to the target cell (AV:A adjacent, not internet-routable) and is triggered during the connection-setup procedure by injecting a malformed uplink message with an invalid NAS payload. No authentication (PR:N) and no user interaction (UI:N) are needed, and it works against affected default configurations of the Baicells Nova 430H eNodeB (model pBS3101SH) running BaiBLQ_3.0.12 or earlier. The realistic limiting factor is physical radio range: an attacker must be near the deployment with equipment capable of emulating a UE/uplink transmission, which prevents remote or large-scale automated exploitation. |
| Impact | This is a genuine but bounded availability threat, not a high-CVSS paper tiger. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N, VA:H/SA:H) is internally consistent with the description: an unauthenticated attacker merely within radio range sends one malformed connection-setup message and triggers a signaling-association shutdown affecting the entire cell - impact propagates from the eNodeB to the core network (SA:H), justifying the elevated 8.3 score. The impact profile is availability-ONLY (VC:N/VI:N, no data exposure or code execution), so this is a targeted denial-of-service, not a compromise. No EPSS score, no CISA KEV listing, and no public exploit are provided, so exploitation status is 'no public exploit identified at time of analysis.' The limiting factor is the AV:A radio-proximity requirement - an attacker needs RF range of the cell, not internet reach - which curbs mass/automated exploitation but is trivial for anyone physically near a private-LTE/CBRS deployment. Note the input Tag 'Information Disclosure' directly contradicts the CVSS vector (VC:N): this is a service-disruption bug, not a disclosure - treat the tag as erroneous, not as a second impact signal. |
| Exploit ScenarioDerived | An attacker with a software-defined radio or rogue UE positioned within RF range of a Baicells Nova 430H cell transmits a malformed uplink message during connection setup carrying an invalid NAS payload. The eNodeB fails to validate the payload and relays it to the core, which tears down the cell's signaling association, knocking the cell offline until connectivity is re-established. No public proof-of-concept is identified, and the attack is adjacent/radio-range only rather than remotely reachable over the internet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 29, 2026
Malformed uplink signaling during connection setup can break the signaling association between a Baicells Nova 430H eNodeB (model pBS3101SH) and its core network, producing a temporary, cell-wide service outage until connectivity is re-established. An unauthenticated attacker within radio range - using equipment capable of emulating UE uplink traffic - can inject an invalid NAS payload that the eNodeB fails to validate before forwarding it to the core, which then tears down the signaling association; no credentials or user interaction are required. The condition affects BaiBLQ_3.0.12 and earlier, but the requirement for RF/radio-frequency proximity keeps this a bounded, localized availability threat rather than an internet-scale one, and no public exploit code has been identified at time of analysis.
Earlier versions of this analysis (1)
Unauthenticated LTE radio-adjacent attackers can crash the signaling link on Baicells Nova 430H eNodeBs (model pBS3101SH, firmware 3.0.12 and earlier) by sending a malformed uplink message with an invalid NAS payload during RRC/NAS connection setup, which the eNodeB relays to the core network and thereby tears down the cell's signaling association for a short period. The result is a bounded, self-recovering availability impact rather than data compromise: no confidentiality or integrity loss is scored (C:N/I:N/A:H) and the CVSS 3.1 base score is 7.4 with an adjacent attack vector, low complexity, and no authentication or user interaction. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the vendor/CISA advisory ICSA-26-272-04 is the primary source.
RemediationAI
No vendor-released patch is identified in the provided data; the only authoritative source is CISA ICS-CERT advisory ICSA-26-272-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-04), which should be monitored for a fixed BaiBLQ firmware release and applied when it becomes available. Because the trigger is RF-adjacent rather than network-routable, the practical mitigations are physical and monitoring controls with real trade-offs: constrain the cell's RF footprint (downtilt, reduced transmit power, directional or shielded antenna placement, or RF screening of the site perimeter) so that unauthorized transmitters cannot reach the receiver, accepting reduced legitimate coverage as the cost; enforce physical access control and surveillance around the site and its coverage area to deter the required proximate attacker; and instrument the MME/S1 interface to alert on repeated S1 signaling-association teardown or reset events correlated with abnormal uplink NAS messages, so that an attack is detected quickly and the cell's recovery window is minimized. Disabling or filtering NAS relay behavior at the eNodeB is not an available lever, since the device is designed to pass NAS payloads transparently; the only durable fix in the affected firmware generation is the vendor update. Until a fix is confirmed and deployed, treat cells running BaiBLQ_3.0.12 as having a known, repeatable availability exposure, and note that no public exploit code has been identified at time of analysis.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Baicells Nova 430H is an LTE eNodeB base station (CPE identifies the exposed platform as cpe:2.3:a:baicells:nova_430h_enodeb__(model_pbs3101sh)) whose firmware, BaiBLQ_3.0.12 and earlier, relays control-plane traffic between UEs and the mobile core. During the connection-setup procedure, uplink messages carry NAS (Non-Access Stratum) payloads that the eNodeB is expected to treat as opaque and pass toward the MME/core over the S1 signaling interface; because the device does not properly validate that payload, a crafted invalid NAS element is relayed upstream, where the core reacts by shutting down the S1 signaling association for the cell. CWE-248 (Uncaught Exception) captures the root cause: an input condition the radio access code does not anticipate or safely handle, allowing a malformed message to propagate into a state that terminates a shared signaling resource. Scores align across vectors - NVD records CVSS 4.0 8.3 with AV:A/PR:N/UI:N and high availability impact on both the vulnerable system and the subsequent system (VA:H/SA:H), and the independent assessment maps this to CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, where S:C reflects that the integrity of the cell's connectivity to the core, not just the eNodeB itself, is degraded. Note that the 4.0 vector is a wireless-adjacent, unauthenticated availability issue only: there is no confidentiality or integrity impact in either assessment.
Know when Nova 430H Enodeb Model Pbs3101Sh gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Radio-range attacker gives AV:A; unauthenticated single malformed message gives AC:L/PR:N/UI:N; impact crosses from eNodeB to core so S:C, availability-only A:H with C:N/I:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdown of the signaling association for the cell. This results in a temporary service disruption until the eNodeB and core network re-establish connectivity.
Executive ViewAI
Baicells Nova 430H eNodeB devices (model pBS3101SH) running BaiBLQ_3.0.12 and earlier can suffer a temporary cell-wide service outage when malformed uplink signaling breaks the signaling association with the core network. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, but an attacker within radio-frequency range could disrupt coverage for an affected cell. Leadership should prioritize inventory and interim mitigations because these radios may support critical communications, and outages could affect customers, operations, or safety until service is restored.
Interim mitigations: restrict physical and RF access to eNodeB antennas and equipment where feasible; monitor for signaling association resets and cell outages; engage Baicells for a validated workaround; deploy redundant coverage or failover for critical sites; and isolate affected cells from reliance on a single eNodeB until vendor firmware is available. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB