CVE-2023-0776

Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. 

• CWE-79
• CWE-77

• https://baicells.com/Service/FirmwarePatch, Vendor Advisory
• https://baicells.com/Service/FirmwarePatch, Vendor Advisory

Published

Feb 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-0770Stack-based Buffer Overflow in GitHub repository gpac/gpac p…7.8
• CVE-2023-0771SQL Injection in GitHub repository ampache/ampache prior to …8.8
• CVE-2023-0772The Popup Builder by OptinMonster WordPress plugin before 2.…6.5
• CVE-2023-0773The vulnerability exists in Uniview IP Camera due to identif…9.8
• CVE-2023-0774A vulnerability has been found in SourceCodester Medical Cer…9.8
• CVE-2023-0775An invalid ‘prepare write request’ command can cause the Blu…6.5
• CVE-2023-0777Authentication Bypass by Primary Weakness in GitHub reposito…9.8
• CVE-2023-0778A Time-of-check Time-of-use (TOCTOU) flaw was found in podma…6.8
• CVE-2023-0779At the most basic level, an invalid pointer can be input tha…7.7
• CVE-2023-0780Improper Restriction of Rendered UI Layers or Frames in GitH…5.4
• CVE-2023-0781A vulnerability was found in SourceCodester Canteen Manageme…9.8
• CVE-2023-0782A vulnerability was found in Tenda AC23 16.03.07.45 and clas…9.8