MediaTek Modem CVE-2026-20479

The critical prerequisite is that the target User Equipment (UE) must have connected to an attacker-controlled rogue base station - this is not a standard internet-reachable attack. The attacker must operate cellular radio infrastructure (a fake base station, e.g., using open-source LTE/5G stacks on SDR hardware) and be within radio range of the target device. Once the UE associates with the rogue base station, no user interaction and no device-side privileges are required. The limiting factor is the infrastructure cost and physical proximity requirement for deploying credible cellular impersonation infrastructure, which constrains exploitation to well-resourced threat actors. The device automatically connects to the strongest available signal, so no user action is needed after the rogue base station is operational. There is no non-default configuration requirement on the victim device - any UE using an affected MediaTek chipset with cellular enabled is potentially vulnerable.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects the no-interaction, no-auth nature of the attack and the full availability impact, but warrants contextualization: AV:N here represents the cellular radio interface, not a standard internet reachable service, and effectively requires the attacker to operate a rogue base station within range of the target. This is a materially higher barrier than a typical network-vector web vulnerability, and arguably AC should be considered elevated from a practical standpoint. EPSS at 0.21% (11th percentile) and SSVC 'exploitation: none' strongly suggest no active in-the-wild exploitation. SSVC does flag the attack as 'automatable' - once rogue base station infrastructure is deployed, attacks can be scripted against any connecting UE without per-target manual effort. Technical impact is 'partial' per SSVC, consistent with a DoS-only outcome. The 'Information Disclosure' tag from the intelligence feed conflicts with the official description, which states only availability impact; this may reflect theoretical memory exposure from an OOB read but is not confirmed by the vendor advisory. The realistic threat actor for this vulnerability is a well-resourced adversary capable of deploying rogue cellular infrastructure, limiting opportunistic exploitation.

An attacker deploys a software-defined radio rogue base station broadcasting a stronger signal than legitimate towers in the target area, causing nearby UEs running affected MediaTek chipsets to automatically associate with it. The attacker's rogue base station then transmits a crafted cellular protocol message containing a data unit that lacks proper length bounds, triggering the OOB read in the modem firmware and causing the modem to crash, resulting in complete loss of cellular connectivity on the victim device. No POC code has been publicly identified at time of analysis, but the attack technique aligns with well-documented rogue base station frameworks used in security research.