MediaTek Modem CVE-2026-20503

Exploitation requires a UE running unpatched MOLY modem firmware on one of the 57 listed MediaTek chipsets (MT2716 through MT8893 series) to have connected to an attacker-controlled rogue base station. Modern mobile devices can automatically camp on a rogue cell without user awareness if the rogue cell presents a stronger signal than the legitimate carrier. No privileges, authentication, or deliberate user interaction on the victim device are required once the connection is established. Limiting factors: (1) the attacker must physically operate RF transmitter hardware (SDR equipment, rogue eNodeB/gNB software) capable of impersonating a cellular base station; (2) the attacker must be geographically adjacent to the victim - this is a radio-range, not internet-range, attack; (3) the device must be running unpatched firmware on one of the affected chipset variants; (4) SSVC rates automatable as 'no', reflecting the manual setup and targeting inherent in rogue base station attacks.

The provided CVSS 5.3 (Medium) with AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the constrained threat model: impact is availability-only (modem crash, device DoS), there is no confidentiality or integrity compromise, and the adjacent attack vector requires the attacker to physically operate a rogue base station with SDR or equivalent RF equipment. AC:H correctly captures that forcing a UE to camp on a rogue cell requires defeating network selection logic, jamming, or exploiting weak signal conditions. SSVC corroborates this - Exploitation: none, Automatable: no, Technical Impact: partial - placing this below triage priority for most enterprise security teams. The massive chipset deployment footprint (premium-to-budget Android devices globally) means the affected population is enormous, but the practical attacker pool is narrow due to the technical and logistical demands of rogue base station operation. No EPSS score was provided; CISA KEV is not listed. The primary residual risk is nation-state or targeted physical-proximity attacks against high-value individuals rather than opportunistic mass exploitation.

An attacker operating a software-defined radio (SDR) rig broadcasting a rogue LTE or 5G cell in a targeted location - such as outside a high-value target's office or residence - causes a nearby device using a vulnerable MediaTek chipset to connect to it in preference to a legitimate carrier cell. Once the UE has camped on the rogue cell, the attacker transmits a crafted malformed radio-protocol message that triggers the missing bounds check in the MOLY modem firmware, crashing the modem subsystem and rendering the device unable to place calls, receive messages, or use mobile data until rebooted. No public exploit code for this specific vulnerability has been identified.