MediaTek Modem CVE-2026-20525

Exploitation requires the attacker to operate a rogue (attacker-controlled) base station and to get the victim UE to connect to it over the cellular radio interface (AV:A, adjacent/proximity) - this is the explicit precondition stated in the description ('if a UE has connected to a rogue base station controlled by the attacker'). No authentication is required (PR:N) and no user interaction is needed (UI:N). Limiting factors that reduce realistic risk: the attacker must be within radio range and must successfully lure/force the device onto the rogue cell (reflected in the high attack complexity AC:H), the impact is limited to denial of service (modem/system crash) with no confidentiality or integrity effect, and the device must use one of the listed affected MediaTek chipsets (e.g. MT6991, MT6988, MT6897, MT8755 and others in the EUVD list).

This is a genuinely moderate-to-low real-world priority despite affecting a large vendor. The CVSS vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H = 5.3) tells a coherent story: the attack is adjacent (AV:A), not remote over the internet - it requires radio proximity, and the high attack complexity (AC:H) reflects the need to stand up a rogue base station and induce the target UE to attach to it. No privileges or user interaction are required (PR:N/UI:N), but the AC:H and AV:A conditions are significant practical barriers. Impact is availability-only (A:H, C:N/I:N) - a modem/system crash, i.e. denial of service, with no code execution or data exposure (consistent with CWE-617, a reachable assertion). All exploitation signals agree that this is not an urgent widespread threat: CISA SSVC lists Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; there is no CISA KEV listing and no public proof-of-concept in the provided data. The 'Automatable: no' rating aligns with AV:A/AC:H - this cannot be sprayed across the internet and must be mounted against a target in radio range one device at a time. The description's phrase 'remote denial of service' refers to over-the-air delivery from the rogue base station, not internet-remote reachability; the CVSS AV:A correctly captures this and the two are consistent rather than conflicting. Bottom line: a legitimate bug worth patching via the vendor bulletin, but low likelihood of opportunistic mass exploitation and better characterized as a targeted/proximity attack.

An attacker operating a rogue cellular base station within radio range of a victim's MediaTek-based device coerces the handset to attach to the malicious cell, then sends a malformed modem message that fails input validation and triggers an assertion/crash. The result is a denial of service (modem/system crash) against that specific device, with no data theft or code execution. No public exploit code is identified at the time of analysis, and the rogue-base-station requirement plus high attack complexity limit this to proximity/targeted use.