CVE-2023-1097 – Baicells EG7035-M11 devices with vulnerable fir... (How to Fix)

Q: What is the severity of CVE-2023-1097?

CVE-2023-1097 has a CVSS score of 9.3 (CRITICAL). Baicells EG7035-M11 devices with vulnerable firmware allow remote attackers to execute arbitrary commands with root privileges via HTTP GET requests without authentication. This affects all devices running firmware BCE-ODU-1.0.8 and earlier. Attackers can fully compromise affected devices and potentially pivot to other network resources.

📋 TL;DR

Baicells EG7035-M11 devices with vulnerable firmware allow remote attackers to execute arbitrary commands with root privileges via HTTP GET requests without authentication. This affects all devices running firmware BCE-ODU-1.0.8 and earlier. Attackers can fully compromise affected devices and potentially pivot to other network resources.

💻 Affected Systems

Products:

Baicells EG7035-M11

Versions: BCE-ODU-1.0.8 and earlier

Operating Systems: Embedded Linux

Default Config Vulnerable: ⚠️ Yes

Notes: All devices with the affected firmware versions are vulnerable in default configuration. No special configuration required for exploitation.

📦 What is this software?

Eg7035 M11 Firmware by Baicells

View all CVEs affecting Eg7035 M11 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device takeover leading to persistent backdoor installation, network pivoting to internal systems, data exfiltration, and use as botnet nodes for DDoS attacks.

🟠

Likely Case

Remote code execution leading to device compromise, credential theft, network reconnaissance, and potential lateral movement within the network.

🟢

If Mitigated

Limited impact if devices are behind firewalls with strict ingress filtering and network segmentation prevents lateral movement.

🌐 Internet-Facing: HIGH - Devices exposed to the internet can be directly exploited without authentication, allowing immediate root access.

🏢 Internal Only: MEDIUM - Internal attackers or compromised internal systems could exploit this, but requires network access to the devices.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted HTTP GET requests. The vulnerability has been validated by third-party researchers, making weaponization likely.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: BaiCE_BM_2.5.26_NA.bin

Vendor Advisory: https://community.na.baicells.com/t/baice-bm-2-5-26-new-cpe-software-has-been-released/1756

Restart Required: Yes

Instructions:

1. Download firmware BaiCE_BM_2.5.26_NA.bin from vendor site. 2. Access device management interface. 3. Navigate to firmware update section. 4. Upload and apply the new firmware. 5. Reboot device after update completes.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate Baicells devices in separate VLANs with strict firewall rules limiting access to management interfaces.

Access Control Lists

all

Implement network ACLs to restrict HTTP access to Baicells devices only from authorized management stations.

🧯 If You Can't Patch

Immediately isolate affected devices from internet and restrict network access to only necessary management IPs
Implement strict egress filtering to prevent compromised devices from communicating with external command and control servers

🔍 How to Verify

Check if Vulnerable:

Check firmware version via device web interface or SSH. If version is BCE-ODU-1.0.8 or earlier, device is vulnerable.

Check Version:

ssh admin@device_ip 'cat /etc/version' or check via web interface at http://device_ip/status

Verify Fix Applied:

Verify firmware version shows BaiCE_BM_2.5.26 or later after update. Test HTTP GET command injection attempts should no longer execute.

📡 Detection & Monitoring

Log Indicators:

Unusual HTTP GET requests with command injection patterns
Multiple failed authentication attempts followed by successful command execution
Unexpected process creation or system modifications

Network Indicators:

HTTP requests to device management interface containing shell metacharacters or command strings
Outbound connections from devices to suspicious external IPs

SIEM Query:

source="baicells-device" AND (http_method="GET" AND (url="*;*" OR url="*|*" OR url="*`*" OR url="*$(*"))

📊 Metadata

CVE ID: CVE-2023-1097

CVSS v3 Score: 9.3 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-94

Published: March 1, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-1097, you might also want to check these: