Description
A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-14
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A command injection flaw exists in the LuCI Web Interface of the Baicells EG3661M router (BaiCE_BQ6_2.0.5.3_NA). The vulnerability allows an attacker to manipulate arguments for MaxHops, Timeout, or Size in /cgi-bin/luci, resulting in arbitrary OS command execution. This flaw can compromise the confidentiality, integrity, and availability of the device and the network it serves.

Affected Systems

The affected product is the Baicells EG3661M router running firmware version BaiCE_BQ6_2.0.5.3_NA. No other vendors or product variants are listed.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. EPSS data is not available, but the vulnerability is publicly documented and exploits have been shared online, implying a realistic threat of exploitation. The tool is accessible via the web interface, making the attack vector remote. The vulnerability is not yet listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 14, 2026 at 03:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor-released firmware patch or upgrade to a fixed version of Baicells EG3661M.
  • If a patch is unavailable, restrict access to the LuCI interface to trusted networks or IP addresses using a firewall or VPN.
  • Implement input validation or range checks for MaxHops, Timeout, and Size parameters, and monitor logs for anomalous command execution attempts.

Generated by OpenCVE AI on August 14, 2026 at 03:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Baicells EG3661M LuCI Web luci os command injection
First Time appeared Baicells
Baicells eg3661m
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:baicells:eg3661m:*:*:*:*:*:*:*:*
Vendors & Products Baicells
Baicells eg3661m
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Baicells Eg3661m
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-14T01:45:08.073Z

Reserved: 2026-08-13T17:17:29.351Z

Link: CVE-2026-19771

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-14T02:16:24.903

Modified: 2026-08-14T02:16:24.903

Link: CVE-2026-19771

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T03:30:03Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')