Remote OS Command Injection in Baicells EG3661M LuCI Interface

A remote OS command injection vulnerability (CVE-2026-19771) has been identified in the Baicells EG3661M wireless router, specifically affecting firmware version BaiCE_BQ6_2.0.5.3_NA. The flaw exists within the LuCI web interface component, specifically within the /cgi-bin/luci file. An attacker can trigger this vulnerability by manipulating specific input arguments, namely 'MaxHops', 'Timeout', or 'Size'. Successful exploitation allows for the execution of arbitrary operating system commands on the affected device. Public exploit code for this vulnerability is available, and the vendor has not provided a response or a patch as of the time of disclosure.

Attack Chain

1. The attacker identifies an internet-facing Baicells EG3661M device running the vulnerable firmware.
2. The attacker navigates to the management interface hosted on the device.
3. The attacker prepares a crafted HTTP request targeting the /cgi-bin/luci endpoint.
4. The attacker injects malicious shell metacharacters into one of the vulnerable parameters: MaxHops, Timeout, or Size.
5. The web server process, executing with elevated privileges, improperly sanitizes the input before passing it to a system call.
6. The injected OS command is executed by the router's underlying operating system.
7. The attacker achieves persistent remote command execution to perform further malicious actions, such as configuration modification or credential theft.

Impact

Successful exploitation results in full control over the affected Baicells EG3661M device. Given that these are routing and networking appliances, impact includes potential interception of network traffic, device bricking, or utilization of the router as a pivot point within the local network.

Recommendation

Prioritize the isolation of the management interface of all Baicells EG3661M devices from the public internet. Ensure the management interface is only accessible via a secure, private network or VPN. Since the vendor has not provided a patch, consider upgrading to an alternative hardware solution or strictly enforcing access control lists (ACLs) to restrict access to the /cgi-bin/luci endpoint.