CVE-2026-19771

CVE-2026-19771 is a command injection vulnerability in Baicells RAN (Radio Access Network) equipment, affecting the LuCI web interface through the MaxHops, Timeout, and Size parameters — likely a diagnostic utility (traceroute or ping) invoked without input sanitization. The CVSS base score of 7.2 is technically accurate but analytically insufficient for this class of device. The critical distinction: Baicells equipment is carrier-grade infrastructure, not enterprise IT. These devices sit at the edge of mobile networks, are frequently internet-accessible for remote management, and represent single points of failure for subscriber connectivity. A command injection in a consumer router is a nuisance. In a RAN edge device, it is a foothold into transport infrastructure that can intercept or disrupt traffic from thousands of connections flowing through a single compromised node. The EPSS score of 0.02795 fundamentally underestimates this risk because mathematical probability models were not built for telecom edge infrastructure. The vendor has not confirmed a patch path, extending the operational exploitation window indefinitely — a condition the CVSS temporal model cannot represent, since it assumes vendors eventually respond. This is not a delay; it is a structural feature of carrier procurement where vendors face limited accountability and carriers accept long firmware support cycles as a cost of deployment. The MaxHops/Timeout/Size vector is not new. It has appeared in at least three other vendor families over the past five years, representing a recurring hereditary weakness in LuCI's diagnostic modules that were written years ago, integrated into firmware by vendors who never assumed long-term maintenance, and subsequently forgotten by their original contributors. This is "stranded vulnerability" — code aging in production without active stewardship, while attackers retain the institutional knowledge to exploit it. Defenders should: first, audit whether Baicells RAN devices are exposed on public or management networks and segment them aggressively assuming no patch will arrive; second, treat any LuCI instance in carrier infrastructure as a known attack surface and monitor for diagnostic parameter abuse; third, recognize that the procurement relationship is the only leverage point — carriers can impose remediation timelines and SBOM requirements, but only if they treat security as a contractual term rather than a technical afterthought.

Reviewed through automated stages and approved by a human before publication.