A critical OS command injection vulnerability (CWE-78) across multiple Baicells wireless products enables unauthenticated remote code execution and full system compromise.

The software fails to properly sanitize input before passing it to a system shell (CWE-78), allowing unauthenticated remote attackers to execute arbitrary system commands.

With a CVSS score of 9.8, this vulnerability allows for complete system takeover, including data exfiltration, service disruption, and the potential use of the device as a pivot point into the internal network. The high severity reflects the ease of exploitation (no authentication required) and the catastrophic impact on system integrity and availability.

Immediate Action: Apply the latest firmware updates provided by Baicells immediately to address the command injection flaw.

Proactive Monitoring: Review system logs for suspicious process execution or unexpected outbound connections from the affected base stations.

Compensating Controls: Restrict management access to these devices to specific, trusted IP addresses using access control lists (ACLs) to minimize the attack surface.

Public Exploit Available: Unknown

Given the critical nature of remote code execution vulnerabilities, immediate remediation is required. Organizations utilizing Baicells hardware should verify firmware versions against the list provided and ensure that all vulnerable units are updated to a secure version as soon as possible.