A vulnerability in the Baicells Nova 430H eNodeB can allow an unauthenticated device within radio range to send a malformed connection message that disrupts cellular service, according to a CISA advisory. The affected equipment is the Nova 430H eNodeB, model pBS3101SH, and the flaw is tracked as CVE-2026-96274.

The immediate question for operators is whether the issue enables an internet-based takeover. CISA says it does not: the vulnerability is not remotely exploitable over the internet. Exploitation requires a device within radio range of an affected cell, and the device does not need to authenticate to the eNodeB. The documented result is a temporary denial-of-service condition.

The attack begins during connection setup. An unauthenticated device within radio range can send an uplink message containing an invalid NAS payload. The Nova 430H does not properly validate that payload before forwarding the message to the core network. That handling can trigger a shutdown of the cell’s signaling association, interrupting the communications link between the eNodeB and the core network.

The service interruption is temporary because the advisory says connectivity returns when the eNodeB and core network re-establish the signaling association. The notice does not provide a guaranteed recovery time, explain whether manual intervention is ever required, or describe how many connection attempts would be needed to cause an interruption. Those operational details are not specified in the advisory.

CISA classifies the weakness as CWE-248, or an uncaught exception. In practical terms, the device encounters an unexpected condition while processing the malformed payload and fails to handle it safely. The security consequence identified in the advisory is loss of availability. The CVSS version 3.1 base score is 7.4, rated high, with the vector identifying adjacent-network access, no required privileges, no user interaction, and high impact to availability. The version 4.0 score is 8.3, also rated high.

The radio-range requirement distinguishes this vulnerability from one reachable through the public internet. CISA’s description does not state the necessary physical distance, equipment, transmission power, or whether ordinary client hardware could generate the payload. It also does not report a successful attack in the field.

CISA specifically says that no known public exploitation targeting this vulnerability had been reported to the agency at the time of its advisory. The advisory identifies Qiqing Huang as the person who reported the vulnerability to CISA, but it does not describe a demonstrated incident, affected customer, outage, or campaign using the flaw.

The affected product status is listed as known affected, and CISA says no fix is planned. The advisory also says Baicells had not responded to requests to work with CISA on mitigation. Users of the affected Nova 430H eNodeB are directed to contact Baicells customer support for additional information. No patched firmware version, configuration change, compensating control specific to the malformed NAS payload, or replacement product is identified in the notice.

CISA recommends minimizing network exposure for control-system devices and remote systems, keeping them off the public internet, placing control-system networks and remote devices behind firewalls, and isolating them from business networks. The agency says organizations should perform an impact analysis and risk assessment before deploying defensive measures.

For remote access, CISA recommends more secure methods such as virtual private networks, while warning that VPNs can themselves contain vulnerabilities and must be kept current. The agency also cautions that a VPN is only as secure as the devices connected through it. Organizations are encouraged to implement recommended cybersecurity strategies for proactive defense of industrial control systems.

The advisory’s scope is specific. It names the Nova 430H eNodeB model pBS3101SH, identifies communications and information technology among the relevant sectors, and lists deployment as worldwide. It does not identify other Baicells products as affected, provide a complete inventory of installations, quantify the number of exposed cells, or say whether every configuration of the named model is equally vulnerable.

For operators, the known risk is a radio-proximity denial-of-service attack against a specific eNodeB model. The known limitation is that the flaw is not remotely exploitable through the internet. The advisory reports no known public exploitation, provides no fix, and leaves the practical attack range, recovery process, and prevalence of exposed equipment unspecified. Organizations that observe suspected malicious activity are encouraged by CISA to follow internal incident procedures and report findings to the agency for tracking and correlation.