MediaTek Modem CVE-2026-20457

Exploitation requires two explicit conditions stated in the CVE description: first, the target UE must have connected to a rogue base station controlled by the attacker - this is the essential enabling condition, as the attack is only deliverable through the cellular radio interface, not over IP networks or the internet. Second, the attacker must operate a functional rogue base station capable of attracting UE attachment, which requires specialized hardware (software-defined radio), cellular protocol software, and geographic proximity to the target device. CVSS AC:H encodes this non-trivial infrastructure barrier. Limiting factors include: attack is bounded to adjacent radio-layer access (AV:A), not internet-reachable; rogue base station deployment requires technical expertise and physical presence; no authentication credentials are needed once the device attaches (PR:N); no user interaction is required on the victim device once attached (UI:N); exploitation affects only availability - no confidentiality or integrity impact. The rogue base station prerequisite effectively restricts exploitation to targeted attacks rather than mass internet-scale campaigns, consistent with SSVC 'automatable: no'.

The CVSS 5.3 Medium score is consistent with the actual threat profile. The adjacent network vector (AV:A) bounds exploitation to attackers with the physical-layer capability to operate a rogue cellular base station - this eliminates opportunistic mass exploitation and rules out internet-based attack paths. High complexity (AC:H) further aligns with SSVC's 'automatable: no' designation, reflecting that each attack requires deliberate infrastructure setup and geographic targeting. The availability-only impact (C:N/I:N/A:H) confirms this is strictly a denial-of-service vulnerability with no data exfiltration or code execution potential. No KEV listing, no public POC, and SSVC exploitation rated 'none' all converge on a low immediate operational priority. However, the enormous chipset footprint across mid-range Android devices globally means the theoretical attack surface is very wide, and targeted use against specific high-value individuals - where rogue base station deployment is feasible - remains a realistic scenario for nation-state or advanced threat actors. EPSS data was not provided in the intelligence feed; absence should not be interpreted as confirmation of low exploitation probability.

An attacker deploys a rogue LTE or 5G base station - using commercially available software-defined radio hardware combined with open-source base station software - in proximity to a target location such as a conference venue, government building, or residence. Nearby devices containing affected MediaTek chipsets automatically associate with the rogue cell due to signal strength. The attacker then transmits crafted downlink signaling messages designed to trigger the null pointer dereference in the modem firmware, causing the victim device's modem to crash and lose all cellular connectivity without any action required from the user. No public exploit code exists at time of analysis, so successful execution requires independent vulnerability research and protocol-level exploit development.