noindex and left out of the sitemap until more data is confirmed.CVE-2026-96274 is a CWE-248 uncaught-exception flaw in the Baicells Nova 430H small-cell eNodeB that lets an unauthenticated device within radio range send a malformed uplink NAS payload and crash the cell's signaling association, but NVD has not completed its own analysis, it is not on the CISA KEV catalog, and Baicells has not responded to CISA's coordination with no fix planned, so this page stays pending with no NVD-confirmed score.
Vulnerability summary
N/A
Not yet scored
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-09-29
Published
Vulnerability ID: CVE-2026-96274 · Source: NVD (CISA ICS-CERT Secondary score only, not NVD Primary; vulnStatus: Awaiting Analysis)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Baicells Nova 430H eNodeB (model pBS3101SH) | — | firmware BaiBLQ_3.0.12 and earlier; no fixed version published, no NVD-listed CPE configuration as of this review |
What this means
CVE-2026-96274 is a CWE-248 (Uncaught Exception) vulnerability in the Baicells Nova 430H, a 4G LTE small-cell eNodeB (model pBS3101SH) used to extend cellular coverage for carriers and enterprises. CISA's ICS advisory describes it precisely: "In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdown of the signaling association for the cell. This results in a temporary service disruption until the eNodeB and core network re-establish connectivity" (CISA ICS Advisory ICSA-26-272-04).
As of this review, NVD lists the CVE's vulnStatus as "Awaiting Analysis" with no Primary score published. The only metrics on record are CISA ICS-CERT Secondary scores: CVSS v3.1 7.4 (high), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, and CVSS v4.0 8.3 (high), reflecting an adjacent-network attack vector (the attacker must be within radio range of the cell) requiring no authentication or user interaction (NVD).
CISA's advisory states the vulnerability "is not exploitable remotely" over the internet, but explicitly notes that "Baicells has not responded to requests to work with CISA to mitigate this vulnerability," lists the remediation category as "no_fix_planned," and directs affected users to "contact Baicells customer support for additional information" rather than offering a patched firmware version (CISA ICS Advisory ICSA-26-272-04).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.00159 (5.038th percentile) — a low figure consistent with a radio-range-only DoS against a niche telecom product rather than a broadly scanned internet-facing service (FIRST EPSS). The CVE is confirmed absent from the live CISA KEV catalog by exact cveID match this run (CISA KEV catalog).
Until NVD completes its own analysis, treat the 7.4-8.3 range above as indicative only, not NVD-confirmed. Because there is no vendor fix and no vendor engagement, operators of Nova 430H small cells should treat radio-layer exposure as an accepted, unpatched risk, monitor for repeated signaling-association resets as a sign of abuse, and press Baicells support directly for a remediation timeline.
Evidence
- An unauthenticated device within radio range can send a malformed uplink NAS payload during connection setup that the Nova 430H eNodeB forwards unvalidated to the core network, shutting down the cell's signaling association and causing temporary denial of service. — CISA ICS Advisory ICSA-26-272-04
- NVD vulnStatus is Awaiting Analysis with no NVD Primary score; only CISA ICS-CERT Secondary scores exist (CVSS v3.1 7.4, v4.0 8.3), adjacent-network attack vector. — NVD
- Baicells has not responded to CISA's coordination attempts; remediation category is "no_fix_planned" and affected users are directed to Baicells customer support. — CISA ICS Advisory ICSA-26-272-04
- EPSS score is 0.00159 (5.038th percentile) as of 2026-10-29; the CVE is confirmed absent from the live CISA KEV catalog by exact cveID match this run. — FIRST EPSS
