What is the CVSS score of CVE-2026-21548?

CVE-2026-21548 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Unisoc NR Modem are affected by CVE-2026-21548?

A HIGH severity vulnerability in Unisoc's 5G modem components affects multiple chipset models (T8100, T8200, T8300, T9100) and enables remote denial-of-service attacks that crash or disable the modem…

How to fix or mitigate CVE-2026-21548?

Within 24 hours, conduct a comprehensive inventory of all deployed devices and products incorporating Unisoc T8100, T8200, T8300, or T9100 chipsets, and assess network exposure for systems accessible to untrusted networks. Within 7 days, implement network segmentation to restrict modem communications where technically feasible, deploy intrusion detection rules to identify malformed input patterns targeting modem subsystems, and contact device manufacturers and Unisoc directly for patch timelines and interim firmware updates. Within 30 days, apply all released vendor patches and firmware updates to affected devices immediately upon availability; for systems without available patches, establish continuous monitoring for exploitation attempts and maintain rapid device isolation or replacement procedures if active attacks are detected.

Unisoc NR Modem CVE-2026-21548

EUVD-2026-52229 HIGH

Improper Input Validation (CWE-20)

2026-08-03 Unisoc

GHSA-g497-jcg3-rfwj

Denial Of Service T8100 T9100 T8200 T8300 Unisoc Shanghai Technologies Co Ltd

7.5

CVSS 3.1 · Vendor: Unisoc

Severity by source

Vendor (Unisoc) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

AV:N for OTA modem attack surface; AC:H because exploiting the NR modem requires controlling or spoofing a 5G base station, a non-trivial capability; PR:N pending vendor clarification of the 'System execution privileges' language; A:H for full availability loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Unisoc).

CVSS VectorVendor: Unisoc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 08:25 vuln.today

CVE Published

Aug 03, 2026 - 07:18 cve.org

HIGH 7.5

DescriptionCVE.org

In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed.

AnalysisAI

Improper input validation in Unisoc's NR (5G New Radio) modem component affects T8100, T9100, T8200, and T8300 chipsets, enabling remote denial-of-service against devices incorporating these baseband processors. The modem's failure to validate incoming data can be triggered remotely, causing an availability impact classified as High - effectively crashing or disrupting the modem subsystem. No public exploit code has been identified at time of analysis, and the vulnerability was disclosed by Unisoc via their product security bulletin.

Technical ContextAI

The NR modem refers to the 5G New Radio baseband modem component implemented in Unisoc's T8100, T9100, T8200, and T8300 system-on-chip (SoC) families (CPE: cpe:2.3:a:unisoc_(shanghai)_technologies_co.,_ltd.:t8100/t9100/t8200/t8300). These chipsets are used in budget and mid-range Android devices. The root cause is improper input validation - an instance of CWE-20 - where the NR modem stack fails to sufficiently sanitize or bounds-check data received across the radio interface before processing it, leading to an abnormal termination or crash of the modem process. The NR protocol stack is a complex, privileged component that handles 5G air-interface signaling, making it a high-value target for over-the-air attacks.

RemediationAI

Apply firmware updates for the affected Unisoc T8100/T9100/T8200/T8300 chipsets as released by Unisoc through their product security bulletin at https://www.unisoc.com/en/support/product-security-bulletin/2084109408382668801. Exact patched firmware versions were not specified in available data; monitor the vendor advisory for version-specific guidance. Device OEMs integrating these chipsets should incorporate the relevant modem firmware patch into their Android OTA updates and push those updates to end users promptly. As a compensating control where firmware updates are not yet available, restricting the device's 5G NR connectivity to trusted or operator-controlled networks - for example, enforcing LTE-only mode through MDM policy - reduces OTA attack surface exposure; this approach trades 5G functionality for reduced modem attack surface and is appropriate for high-sensitivity managed-device environments.