CVE-2026-19771
Received Received - Intake

Command Injection in Baicells EG3661M BaiCE Firmware

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19771
EUVD
EUVD-2026-58564

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
baicells eg3661m From bai_ce_bq6_2.0.5.3_na (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19771 is a command injection vulnerability in Baicells EG3661M devices running firmware BaiCE_BQ6_2.0.5.3_NA. It allows authenticated administrators to inject arbitrary commands via diagnostic handlers for traceroute and ping functions. The issue occurs due to improper input validation and lack of argument separation, enabling shell metacharacters to terminate intended commands and inject malicious payloads. This leads to remote code execution with root privileges.

Detection Guidance

Check for unauthorized access to the LuCI Web Interface endpoints /admin/system/diagnosis_route and /admin/system/diagnosis_ping. Monitor for unusual commands like traceroute or ping with unexpected parameters such as MaxHops, Timeout, or Size containing shell metacharacters. Inspect logs for delayed responses or reverse shell callbacks.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands with root privileges on affected devices. Successful exploitation can lead to theft of password hashes, modification of device configurations, and potential network pivoting to other systems. Attackers may gain full system access, enabling further compromise of the network.

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. Compromise of network devices may lead to data breaches, unauthorized data access, or tampering with logs and configurations. Organizations may face regulatory penalties, loss of trust, and legal consequences due to inadequate security controls.

Mitigation Strategies

Disable the vulnerable endpoints if possible, apply strict input validation to reject shell metacharacters in MaxHops, Timeout, and Size parameters, and update the firmware to a patched version. Restrict access to the web interface to trusted networks only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19771. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart