Unauthenticated Radio‑Range DoS in Baicells Nova 430H eNodeB (CVE‑2026‑96274)
What It Is — Baicells Nova 430H eNodeB (model pBS3101SH) versions ≤ BaiBLQ_3.0.12 contain an unauthenticated input validation flaw (CVE‑2026‑96274). An attacker within radio range can send a malformed uplink message with an invalid NAS payload, which the eNodeB forwards to the core network, causing a signaling shutdown and temporary service outage.
Exploitability — The vulnerability is publicly disclosed, has a CVSS v3 base score of 7.4 (High), and can be exploited without credentials or prior access. No vendor‑issued fix is currently available.
Affected Products — Baicells Technologies – Nova 430H eNodeB (model pBS3101SH) firmware ≤ BaiBLQ_3.0.12.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous validation of third‑party equipment against security baselines; evidence of such validation is a core control‑assurance artifact.
- Highlights gaps in network‑level monitoring: without telemetry that flags malformed NAS payloads, organizations lack defensible evidence of timely detection.
- Forces telecom operators to document vendor‑risk mitigation (e.g., segmentation, fallback procedures) to satisfy audit expectations across frameworks that map to the “Network Security” control objective.
Recommended Actions
- Inventory all deployed Nova 430H units and verify firmware versions.
- Apply any interim mitigations (e.g., radio‑range access controls, strict ACLs) while awaiting a vendor patch.
- Deploy IDS/IPS rules that detect abnormal NAS payloads and generate alerts for rapid incident response.
- Document the risk in your third‑party risk register and capture remediation evidence for audit trails.
- Engage Baicells directly for a remediation timeline and consider alternative equipment if a fix is not forthcoming.
Source: CISA Advisory – ICSA‑26‑272‑04