MediaTek Modem CVE-2026-20459

Exploitation requires that the target User Equipment (UE) - a smartphone, tablet, or other cellular device powered by one of the 80+ affected MediaTek chipsets - has connected to a rogue base station controlled by the attacker. The attacker must physically deploy a false base station (e.g., via SDR hardware) within radio range of the target, and the device must autonomously attach to it (typically because the rogue station broadcasts a stronger signal than legitimate cells). No authentication, credentials, or user interaction on the target device are required once the device is connected to the rogue cell. Exploitation is limited by: (1) the requirement for physical proximity and specialized radio equipment to operate a rogue base station; (2) the cellular radio band(s) supported by both the attacker's equipment and the target chipset; (3) the difficulty of reliably attracting a specific target device to a rogue cell without affecting surrounding devices; and (4) the impact being limited to denial of service (crash) with no data exfiltration or persistent compromise.

The CVSS 3.1 base score of 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a moderate-severity, adjacent-network, high-complexity attack. The AV:A designation is accurate - the attacker must operate a rogue cellular base station within radio range of the target device, a significant operational and legal barrier that drives AC:H. Impact is confined to availability (A:H, system crash), with no confidentiality or integrity compromise. SSVC concurs: exploitation status is none, the attack is not automatable (requiring specialized radio equipment and proximity), and technical impact is partial. EPSS data is not provided in the input, so probabilistic exploitation likelihood cannot be quantified. This is not a KEV-listed vulnerability. The combination of high operational cost (rogue base station deployment) and DoS-only outcome places this firmly in a targeted, nation-state or sophisticated-actor scenario rather than opportunistic mass exploitation. The primary real-world risk is targeted disruption of specific individuals' devices (e.g., journalists, executives, activists) by a sufficiently resourced adversary. The absence of C/I impact limits attacker utility and further depresses prioritization for most enterprise defenders.

A threat actor with access to software-defined radio (SDR) equipment deploys a rogue LTE or NR base station broadcasting a stronger signal than legitimate towers in a target's vicinity - a technique sometimes called an IMSI catcher or false base station. A target device running a vulnerable MediaTek modem autonomously attaches to this rogue cell; the attacker then transmits a specially crafted over-the-air protocol message that the modem's input validation logic fails to handle correctly, triggering a system crash and rendering the device temporarily inoperable. No public exploit code is known at time of analysis.