PatchTheCVECVE-2022-24693: Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that ar
CVE-2022-24693 is a critical-severity flaw (CVSS 9.8) affecting nova436q firmware, neutrino 430 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 3.3% (top 11%) |
| CISA exploited list | No |
| Weakness | CWE-798 |
| Published | 2022-03-30 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-24693?
nova436q firmware: upgrade to newer than qrtb_2.7.8; neutrino 430 firmware: upgrade to newer than qrtb_2.7.8. Exact commands for each OS are on this page.
Is CVE-2022-24693 being exploited?
CVE-2022-24693 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-24693 affect?
CVE-2022-24693 affects nova436q firmware, neutrino 430 firmware. Severity is critical (CVSS 9.8). Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, enc
How urgent is CVE-2022-24693?
Priority 61/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-0776 HIGH 8.1 UPGRADE UPGRADE Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2