What is the CVSS score of CVE-2026-20435?

CVE-2026-20435 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openwrt are affected by CVE-2026-20435?

CVE-2026-20435 presents moderate security risk rated CVSS 4.6. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-20435?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Openwrt CVE-2026-20435

MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-03-02 security@mediatek.com

Information Disclosure Openwrt Android Yocto Rdk B Zephyr Google

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 09:16 nvd

MEDIUM 4.6

DescriptionCVE.org

In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.

AnalysisAI

Device unique identifiers in the preloader of Openwrt, Android, Yocto, RDK-B, and Zephyr can be read by attackers with physical access due to a logic error, leading to local information disclosure without requiring additional privileges or user interaction. This vulnerability affects multiple embedded and IoT platforms where the preloader executes before operating system initialization. No patch is currently available for this issue.

Technical ContextAI

Classified as CWE-522 (Insufficiently Protected Credentials). Affects Yocto. In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.