MediaTek DA CVE-2026-20471

Physical access to the target device is an absolute requirement, confirmed by CVSS AV:P. The attacker must place the device into Download Agent (DA) mode, a pre-boot diagnostic state triggered via USB connection and specific hardware key sequences - this is not accessible during normal device operation. No authentication is required once in DA mode (CVSS PR:N), and no user interaction is needed (UI:N). Exploitation is concretely limited by: physical possession of the device, ability to initiate DA boot mode (which may be further restricted by OEM-specific locked-bootloader implementations), and the impact ceiling of local denial of service only - no code execution, privilege escalation, or data exfiltration is possible per available data. Devices not physically accessible to the attacker and devices with DA mode disabled or restricted by OEM configuration are not exploitable.

The CVSS 3.1 vector AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a score of 4.6 (Medium), with the physical attack vector being the dominant risk-limiting factor. EPSS of 0.16% at the 6th percentile confirms very low empirical exploitation probability. SSVC classifies this as non-automatable with no known exploitation and only partial technical impact, all consistent with a physical-access-only, availability-only vulnerability. The CVE is absent from CISA KEV and no POC has been identified. The sole impact is availability - denial of service - with zero confidentiality or integrity consequence, meaning an attacker cannot extract data or execute code based on current data. Signals are internally consistent and present no conflict: this is a low real-world priority despite the memory corruption class (CWE-787). The primary threat actors are those with device possession such as device repair shops, border inspections, or insider access scenarios.

An attacker with physical possession of a vulnerable MediaTek-powered device connects it via USB and uses hardware key combinations or platform-specific tooling to place the device into Download Agent mode at boot time. The attacker then transmits a specially crafted DA protocol message that triggers the out-of-bounds write, corrupting memory and causing the device to crash or become permanently unresponsive. No public exploit code is known to exist, and replicating this attack requires both physical access and knowledge of the DA protocol, making opportunistic exploitation unlikely.