Baicells Nova 430H (CVE-2026-96274)
Unauthenticated attackers within radio range can crash Baicells Nova 430H eNodeB cells by sending malformed NAS payloads, causing temporary denial of service with no vendor fix planned. CVE-2026-96274 allows radio-proximity attackers to send malformed uplink messages with invalid NAS payloads to Baicells Nova 430H eNodeB devices. The eNodeB forwards unvalidated payloads to the core network, triggering a signaling shutdown and temporary service disruption. No patch is planned; vendor has not responded to CISA.
Detection / Hunteropenrouter
Immediate Actions
- Contact Baicells customer support for mitigation guidance
- Monitor eNodeB signaling logs for unexpected association shutdowns
Key Takeaways
- Affected model pBS3101SH firmware versions <=BaiBLQ_3.0.12
- CVSS v3.1 score 7.4 HIGH; v4.0 score 8.3 HIGH
- Attack requires physical radio proximity, not remote network access
- No fix planned; Baicells has not responded to CISA coordination requests
- CWE-248 Uncaught Exception triggers cell signaling association shutdown
Attack Chain
- Initial Access: Unauthenticated attacker within radio range sends malformed uplink message during connection setup
- Execution: Message contains invalid NAS payload not validated by eNodeB
- Impact: eNodeB forwards invalid payload to core network triggering signaling association shutdown
- Recovery: Temporary service disruption until eNodeB and core network re-establish connectivity
Affected Systems
- Baicells Nova 430H eNodeB model pBS3101SH
- Baicells Nova 430H firmware <=BaiBLQ_3.0.12
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-96274 | Baicells Nova 430H eNodeB (model pBS3101SH) | High | Malformed NAS payload causes uncaught exception and temporary DoS. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | Target is telecom eNodeB hardware, not endpoint devices. |
| Network Visibility | Low | Requires specialized radio and core network signaling monitoring. |
| Detection Difficulty | Hard | Requires radio-level monitoring and NAS payload inspection capabilities. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unexpected signaling association shutdowns on eNodeB devices following connection setup attempts indicate exploitation of CVE-2026-96274 (T1499.004). | eNodeB signaling and system event logs | Impact | Low — shutdowns tied to invalid NAS payloads are distinctive |
Required Log Sources
- eNodeB signaling logs
- Core network connection logs
- eNodeB system event logs
Key Behavioral Indicators
- Repeated eNodeB signaling association shutdown events
- eNodeB reconnection cycles to core network
- Invalid NAS payloads in uplink connection setup messages
Control Gaps
- No NAS payload validation on eNodeB before core network forwarding
- No rate limiting on connection setup from unauthenticated devices
- No patch available from vendor
False Positive Assessment
Low — signaling association shutdowns triggered by invalid NAS payloads are distinctive and unlikely to occur normally.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Isolate eNodeB management networks from business networks
- Restrict physical radio access to eNodeB sites where feasible
- Use VPNs for remote access to eNodeB management interfaces
User Protection
- Monitor for service disruptions on affected cell sites
MITRE ATT&CK Mapping
Impact
Plain-Language Summary
A security flaw in Baicells Nova 430H cellular base stations lets anyone nearby send a specially crafted radio message that crashes the cell's service temporarily. The base station fails to check the message before forwarding it to the core network, which shuts down the connection. Organizations using these devices should isolate them from untrusted networks and contact Baicells for guidance.
- cveCVE-2026-96274Malformed NAS payload causes uncaught exception and temporary DoS.