nvd-json-data-feeds/CVE-2023/CVE-2023-07xx/CVE-2023-0776.json

{
  "id": "CVE-2023-0776",
  "sourceIdentifier": "security@baicells.com",
  "published": "2023-02-11T01:23:26.113",
  "lastModified": "2023-11-07T04:01:26.697",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce.\u00a0\n\n\n"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0
      },
      {
        "source": "security@baicells.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW",
          "baseScore": 8.1,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.3
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    },
    {
      "source": "security@baicells.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:baicells:neutrino_430_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "qrtb_2.12.7",
              "matchCriteriaId": "9FB9F0E7-8C51-4D55-B962-62EC4792086F"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:baicells:neutrino_430:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F525B37-6593-4534-932D-89C7D28B3C10"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:baicells:nova430l:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C34FDFD-CA68-495B-AC86-A8074E851B92"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:baicells:nova430l_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "qrtb_2.12.7",
              "matchCriteriaId": "3D5BC6AC-0035-47A3-9ED2-653EE67A4EC8"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:baicells:nova430e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF84A685-67A9-4039-B92B-0AC934B6E038"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:baicells:nova430e_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "qrtb_2.12.7",
              "matchCriteriaId": "2B192208-0C0F-4225-A6D0-E8F01FFDD7D0"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:baicells:nova436q:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFF872E4-C1A1-4C60-B0CC-3958A99A7E6C"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:baicells:nova436q_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "qrtb_2.12.7",
              "matchCriteriaId": "42EC47B2-A879-41BB-8347-9E40E7FAA123"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://baicells.com/Service/Firmware",
      "source": "security@baicells.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}