Description

A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-14T02:16:24.903Z",
  "pubdate": "2026-08-14T02:16:24.903Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified within the Baicells EG3661M running firmware version BaiCE_BQ6_2.0.5.3_NA. The flaw specifically resides in the LuCI Web Interface component, impacting an unknown function within the /cgi-bin/luci endpoint. By manipulating input parameters such as MaxHops, Timeout, or Size, an unauthenticated remote attacker can inject arbitrary operating system commands that are subsequently executed with the privileges of the underlying web server or system shell.\nThe successful exploitation of this vulnerability results in full remote code execution, potentially allowing malicious actors to compromise the confidentiality, integrity, and availability of the affected Baicells device. Given that the exploit vector is publicly available and network-accessible, the risk level is elevated, especially since the vendor failed to respond to early vulnerability disclosures and no official patch is currently available.\nAttackers do not require physical access and can leverage remote network connections to deliver the malicious payload. The lack of input sanitization and improper neutralization of special elements used in an OS command are the fundamental drivers of this risk, making remediation dependent on strict input validation controls or network-level mitigations.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw originating from improper input validation and sanitization within the LuCI Web Interface component of the Baicells EG3661M device. Specifically, the attack surface is exposed via the /cgi-bin/luci script handler, where user-supplied input parameters—namely MaxHops, Timeout, and Size—are processed by the backend application.\nRoot cause analysis indicates that the underlying application insecurely concatenates or passes these HTTP request arguments directly to system-level execution functions, such as system(), popen(), or similar shell invocation interfaces, without stripping shell metacharacters or validating expected data types and ranges. Because the parameters are designed to handle numeric or configuration values, the lack of rigorous parsing allows an attacker to append command separators (e.g., semicolons, pipes, or backticks) followed by arbitrary shell commands.\nThe attack flow proceeds as follows: First, a remote attacker crafts an HTTP request targeting the /cgi-bin/luci endpoint. Second, the attacker injects malicious OS command payloads into vulnerable parameters such as MaxHops, Timeout, or Size. Third, the LuCI Web Interface component processes the HTTP request and forwards the unsanitized parameter values to the underlying operating system shell. Fourth, the system executes the injected commands with the elevated privileges assigned to the web application process.\nNetwork exposure is high as the management interface is typically accessible over the network. Depending on the device configuration, authentication requirements may be bypassed or circumvented if the endpoint allows unauthenticated access or if the vulnerability lies within a pre-authentication routine. The post-exploitation impact includes complete system compromise, unauthorized data extraction, modification of device configurations, lateral movement within the network, and the potential utilization of the embedded device as a pivot point or botnet node.\nBecause the vendor has not provided an official software patch or firmware update in response to early disclosures, defenders must rely on defensive hardening measures to restrict exposure and block exploit attempts at the perimeter."
}