MediaTek Modem CVE-2026-20504

Exploitation requires two concurrent conditions: (1) the target device must contain one of the 19 affected MediaTek chipsets running unpatched modem firmware, and (2) the device must successfully attach to an attacker-operated rogue base station - requiring the attacker to physically deploy radio infrastructure broadcasting a stronger signal than the legitimate carrier within range of the target. Once the device is camped on the rogue cell, no authentication credentials, device account privileges, or user-initiated actions are required. Limiting factors: AC:H reflects the non-trivial operational investment in deploying rogue cellular infrastructure; the attack is geographically bounded by radio range; impact is strictly availability (crash/reboot), with no data exfiltration or code execution capability confirmed.

The CVSS vector AV:A/AC:H accurately captures the practical threat model: exploitation is bounded by the attacker's ability to deploy rogue cellular base station (fake eNB/gNB) infrastructure within radio range of the target device and to force the device to camp on the rogue cell - a significant operational barrier that limits this to well-resourced adversaries rather than opportunistic attackers. Even a mid-sized municipal IT team in zabrze should treat this as a moderate rather than urgent patching priority, given the high attack complexity and pure availability impact. No EPSS data was provided in the input; no KEV listing and no public POC exist, further reducing immediate urgency. The impact is strictly DoS - CVSS C:N/I:N/A:H - with no confidentiality or integrity consequences. The absence of privilege requirements (PR:N) and user interaction (UI:N) means once a device is attached to a rogue cell, no further conditions apply, but that rogue-cell attachment step is the hard constraint.

An attacker with access to software-defined radio (SDR) equipment configures a rogue eNB or gNB broadcasting a stronger signal than the legitimate carrier in a targeted area, causing a nearby device with an affected MediaTek chipset to automatically camp on the rogue cell. The attacker then transmits malformed modem protocol messages containing out-of-bounds data, triggering the reachable assertion in the modem firmware, crashing the modem subsystem and rendering the device unable to make or receive calls or use mobile data. No public proof-of-concept has been identified.