CISA 2026-09-29

Baicells Nova 430H

CVE-2026-96274

Machine-generated analysis · WAYSCloud LLM

Unauthenticated devices within radio range can send malformed uplink messages that may cause a denial-of-service condition on the eNodeB. The issue affects Nova 430H eNodeB firmware versions up to BaiBLQ_3.0.12.

Context

The advisory concerns Baicells Nova 430H eNodeB (model pBS3101SH) firmware version <=BaiBLQ_3.0.12. An unauthenticated device within radio range can send a malformed uplink message with an invalid NAS payload, which the eNodeB forwards to the core network, potentially triggering a shutdown of the signaling association and causing temporary service disruption. Baicells has not released a fix and advises customers to contact support for additional information.

Operator considerations

Check: Verify the firmware version of each Nova 430H eNodeB is not <=BaiBLQ_3.0.12.
Isolate: Restrict unauthenticated radio access to the eNodeB where feasible.
Log: Monitor for unexpected signaling association shutdowns or service disruptions on affected cells.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to inject malformed messages which may lead to a denial-of-service condition.

The following versions of Baicells Nova 430H are affected:

Nova 430H eNodeB (model pBS3101SH)

Read the full advisory on CISA →