Several Baicells hardware models are affected by a critical vulnerability involving default credentials, which allows unauthenticated attackers to gain full administrative control.

This is a Use of Default Credentials (CWE-1392) vulnerability. The affected devices ship with or maintain default credentials that remain active, allowing an unauthenticated attacker to bypass authentication mechanisms entirely.

The CVSS score of 10.0 reflects the highest possible severity, indicating that an attacker can gain complete control over the networking hardware. This could lead to total network compromise, traffic interception, and the potential for persistent backdoors within the organization's infrastructure.

Immediate Action: Change all default administrative credentials immediately; if firmware updates are available from the vendor, apply them to remediate the underlying issue.

Proactive Monitoring: Monitor network device authentication logs for repeated or successful logins from unauthorized IP addresses or unusual administrative activity.

Compensating Controls: Isolate management interfaces of these devices from the public internet using firewalls or VPNs to restrict access to trusted internal segments only.

Public Exploit Available: Unknown

The presence of default credentials on network infrastructure is a critical security failure. Administrators must immediately change all default passwords and restrict management access to these devices to prevent full-scale network compromise.