{"id":"CVE-2023-1097","aliases":["EUVD-2023-23384","GHSA-rfcc-r6v3-cggj"],"status":"published","title":"Unauthenticated Command Injection EG7035-M11 Series","description":"Baicells EG7035-M11 devices with firmware through  BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party analyst and have been confirmed exploitable special thanks to Lionel Musonza for the discovery.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0113,"percentile":0.6664,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77","CWE-94"],"published":"2023-03-01T19:29:26Z","modified":"2026-06-17T05:27:06Z","products":[{"vendor":"baicells","product":"eg7035-m11"},{"vendor":"baicells","product":"eg7035-m11_firmware"}],"references":[{"url":"https://community.na.baicells.com/t/baice-bm-2-5-26-new-cpe-software-has-been-released/1756","tags":["patch","release-notes","x_transferred","Release Notes"]},{"url":"https://img.baicells.com//Upload/20220524/FILE/BaiCE_BM_2.5.26_NA.bin.bin","tags":["patch","x_transferred","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1097"},{"url":"https://github.com/advisories/GHSA-rfcc-r6v3-cggj"}],"sources":{"cve":[{"id":"CVE-2023-1097","title":"Unauthenticated Command Injection EG7035-M11 Series","description":"Baicells EG7035-M11 devices with firmware through  BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party analyst and have been confirmed exploitable special thanks to Lionel Musonza for the discovery.\n\n\n\n\n\n","status":"published","published":"2023-03-01T19:29:26.456Z","modified":"2025-03-07T15:53:21.691Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2023-23384","description":"Baicells EG7035-M11 devices with firmware through  BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party analyst and have been confirmed exploitable special thanks to Lionel Musonza for the discovery.\n\n\n\n\n\n","status":"published","published":"2023-03-01T19:29:26Z","modified":"2025-03-07T15:53:21Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:10.661676Z"}],"ghsa":[{"id":"GHSA-rfcc-r6v3-cggj","title":"Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code...","description":"Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party analyst and have been confirmed exploitable special thanks to Lionel Musonza for the discovery.","status":"published","published":"2023-03-01T21:30:18Z","modified":"2023-03-16T05:06:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:54:20.892008Z"}],"nvd":[{"id":"CVE-2023-1097","description":"Baicells EG7035-M11 devices with firmware through  BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party analyst and have been confirmed exploitable special thanks to Lionel Musonza for the discovery.\n\n\n\n\n\n","status":"published","published":"2023-03-01T20:15:11.073Z","modified":"2026-06-17T05:27:06.453Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-94","CWE-77"],"updated_at":"2026-11-02T14:07:48.342507Z"}]}}