Baicells Nova 430H
MonitorCVSS 7.4ICS-CERT ICSA-26-272-04Sep 29, 2026
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Baicells Nova 430H eNodeB (model pBS3101SH) version 3.0.12 and earlier contains a vulnerability that allows an attacker to inject malformed messages, causing a denial-of-service condition. The attacker can craft protocol messages that crash or hang the base station, interrupting wireless service. Baicells has not provided a firmware fix and has not engaged with CISA on remediation. The vulnerability is associated with CWE-248 (uncaught exception).
What this means
What could happen
An attacker could send malformed network messages to the Nova 430H base station, causing it to stop responding and interrupting wireless service to connected devices in your coverage area.
Who's at risk
Wireless network operators and municipal utilities deploying Baicells Nova 430H eNodeB base stations for LTE/mobile network coverage should review their deployment. The vulnerability affects the radio access network (RAN) layer and could impact any organization relying on this equipment for continuous wireless connectivity to field devices, mobile workforce, or public access points.
How it could be exploited
An attacker on the same network segment as the Nova 430H could craft and send malformed protocol messages directly to the eNodeB, triggering a denial-of-service condition that crashes or hangs the device.
Prerequisites
- Network access to the Nova 430H eNodeB on the same network segment or via management interface
- No authentication required
no patch availabledenial-of-service impactnetwork-adjacent access requiredno authentication needed
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (1)
ProductAffected VersionsFix Status
Nova 430H eNodeB (model pBS3101SH)≤ BaiBLQ 3.0.12No fix (EOL)
Remediation & Mitigation
0/3
Do now
0/2HARDENINGIsolate Nova 430H eNodeB from untrusted networks using firewall rules and network segmentation; restrict access to management ports to authorized workstations only
WORKAROUNDMonitor Nova 430H eNodeB for unexpected service interruptions or connection drops; establish procedures to quickly power-cycle the device if a denial-of-service is suspected
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXContact Baicells customer support to inquire about firmware updates, security patches, or migration options to fixed versions of the Nova product line
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/7042e240-c222-409b-8543-5e8341a1df69Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.