What is the CVSS score of CVE-2026-20434?

CVE-2026-20434 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Nr17 are affected by CVE-2026-20434?

A critical vulnerability in cellular modem firmware allows remote attackers to gain unauthorized system privileges by impersonating legitimate base stations, potentially compromising any mobile…

How to fix or mitigate CVE-2026-20434?

Within 24 hours: Inventory all devices with affected modems and assess business criticality. Within 7 days: Disable non-essential cellular connectivity where possible, restrict device usage in untrusted network environments, and establish a vulnerability tracking process for vendor patch availability. Within 30 days: Develop a device patching strategy and pilot testing plan for when the vendor patch becomes available; evaluate alternative devices without this vulnerability for future procurement.

Nr17 CVE-2026-20434

HIGH

Out-of-bounds Write (CWE-787)

2026-03-02 security@mediatek.com

Privilege Escalation Nr17 Lr13 Nr16 Lr12a Nr15

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 09:16 nvd

HIGH 7.5

DescriptionCVE.org

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY00782946; Issue ID: MSV-4135.

AnalysisAI

Privilege escalation in Modem affects Nr17, Lr13, Nr16, Lr12a, and Nr15 devices through an out-of-bounds write vulnerability triggered when connecting to a rogue base station. An attacker controlling a malicious base station can achieve remote code execution and full system compromise without requiring additional privileges or user interaction beyond initial network connection. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

Classified as CWE-787 (Out-of-bounds Write). Affects Lr12A. In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY00782946; Issue ID: MSV-4135.