Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain radio proximity / rogue base station
-
ExploitSend malformed modem signaling message
-
ExecutionTrigger improper input validation in modem
-
ImpactModem crash and loss of service
Vulnerability Assessment
| Exploitation Conditions | Exploitation targets the cellular baseband/modem of UNISOC-based devices and is triggered by a crafted/malformed input (signaling message) that the modem fails to validate, causing a system crash. No authentication is required (PR:N) and no user interaction is needed (UI:N). The practical limiting factor is reachability of the modem: baseband flaws of this kind are generally exploited over the air and typically require radio proximity or a malicious/rogue base station to deliver the malformed message, which constrains real-world exploitation despite the AV:N labeling. Impact is limited to availability (device/modem crash); there is no path to code execution, privilege gain, or data disclosure. |
| Impact | This is a genuine but bounded availability risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 purely on a complete availability loss - there is no confidentiality or integrity impact, so the ceiling is a crash/reboot of the device modem, not code execution or data compromise. The EPSS score is low (0.64%, 49th percentile), there is no CISA KEV listing (not actively exploited per available data) and no public exploit code identified, so all exploitation signals point to a low near-term likelihood of widespread weaponization. One important tension: the CVSS vector asserts AV:N (network) with low complexity, but this is a cellular baseband/modem flaw reported by UNISOC, and such bugs in practice are typically reached via over-the-air radio signaling, often requiring a rogue/malicious base station rather than arbitrary Internet reachability - verify the true attack surface with the vendor before treating it as remotely reachable from any network. No CWE was supplied (N/A), though the description ('improper input validation') aligns with CWE-20. Net: a real, patch-worthy DoS affecting device availability, but not a 'drop everything' issue given low EPSS, no KEV, and no known POC. |
| Exploit ScenarioDerived | An attacker within radio range (for example operating a rogue base station or malicious cellular network) sends a crafted, malformed signaling message to a UNISOC-based device's modem. The modem fails to validate the input and crashes, causing a denial of service - loss of cellular connectivity or a device/modem reboot. No public exploit code is identified at time of analysis, and the attack yields no code execution or data access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Malformed cellular signaling messages can crash the baseband/modem firmware on UNISOC-based devices, producing a remote denial of service (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) that requires neither authentication nor user interaction. The flaw is an input-validation failure in modem message handling: when the modem receives a crafted signaling message it fails to parse safely and the system crashes, with no path to code execution, privilege escalation, or data disclosure. Impact is bounded to availability, and real-world exploitation is constrained by the fact that the malicious message must reach the baseband - typically over the air, requiring radio proximity or a rogue/malicious base station. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.64% (49th percentile), indicating a low, non-urgent likelihood of exploitation in the near term.
RemediationAI
Apply the vendor baseband fix referenced in the UNISOC advisory at https://www.unisoc.com/en/support/announcement/1976557615080263681 - patch status and exact fixed firmware versions are not confirmed from the available data, so treat the advisory itself as the source of truth for the fix build. In practice, baseband patches are distributed by device OEMs as full firmware/OTA updates, so affected organizations should obtain the patched firmware directly from the handset or module manufacturer and prioritize devices that operate in physically exposed or untrusted radio environments. Because the trigger is a malformed over-the-air signaling message, conventional host firewalls and endpoint controls do not help; the meaningful mitigations are either radio-level or operational. Practical compensating controls include restricting high-value devices to Wi-Fi-only operation or airplane mode where cellular connectivity is not required (trade-off: loss of voice, SMS, and mobile data), disabling automatic network attachment and manual operator selection so devices do not associate with untrusted or spoofed networks (trade-off: reduced roaming convenience and coverage), and, for mobile network operators, filtering or validating malformed signaling at the core/edge before it reaches subscriber devices (trade-off: additional core-network processing and tuning to avoid dropping legitimate traffic). Device reboots may restore service after a crash but do not remediate the underlying flaw, so firmware update remains the only complete fix.
Affected ProductsAI
The advisory covers devices using UNISOC modem/baseband technology; the vendor announcement at https://www.unisoc.com/en/support/announcement/1976557615080263681 is the authoritative source for the precise chipset list and affected firmware versions, and no CPE strings, model numbers, or version ranges were provided in the supplied data. Because baseband firmware is shipped by UNISOC to handset and module manufacturers and then integrated into OEM firmware, end users are affected indirectly through the devices they own - typically entry-level and mid-range Android smartphones, feature phones, cellular IoT modules, and other equipment built on UNISOC platforms. Administrators and asset owners should map their inventory to UNISOC-based hardware and cross-reference each OEM's security bulletin, since the patch will be delivered as a device firmware update rather than as a standalone downloadable package. Affected status is therefore determined by chipset and OEM firmware build, not by an application-level product version.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the cellular baseband/modem firmware found in devices built on UNISOC chipsets - the same class of software that handles radio resource control and non-access-stratum signaling between the handset and the mobile network. No CWE identifier was assigned by the vendor, but the described root cause (improper input validation, CWE-20 class) is a classic baseband parsing defect: the modem accepts a signaling message without adequately validating its structure, length, or field values and then dereferences or processes invalid data, causing a firmware fault that takes the modem - and reportedly the system - down. Because the vulnerable code lives below the application/OS layer, the attack surface is the radio interface rather than an IP socket; the AV:N rating reflects that the trigger arrives over the air, but exploitation in practice demands that the attacker control or impersonate the network side (for example a rogue base station or a compromised operator node) and be within radio range. No CPE identifiers were supplied with this record, so affected products must be scoped by UNISOC chipset family using the vendor advisory rather than by a machine-readable product list. The only impact per the CVSS vector is A:H - no confidentiality or integrity effect.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated malformed input crashes the modem with no interaction, giving high availability impact and no C/I impact; AV:N retained per vendor though radio-adjacent delivery is likely.
Primary rating from Vendor (unisoc).
CVSS VectorVendor: unisoc
DescriptionCVE.org
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
Executive ViewAI
UNISOC-based devices are affected by a high-severity vulnerability that can crash the baseband/modem firmware, causing temporary loss of cellular connectivity. While unauthenticated and requiring no user interaction, exploitation demands proximity to a malicious or rogue base station, limiting real-world exposure. Leadership should monitor this issue as it could disrupt mobile communications for affected users, but no active exploitation has been confirmed.
No vendor-released patch identified at time of analysis. Interim mitigations are limited to avoiding use of affected devices in areas with potential rogue base stations and monitoring for vendor patches.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB