What is the CVSS score of CVE-2026-21553?

CVE-2026-21553 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Unisoc Modem are affected by CVE-2026-21553?

Unisoc modem chipsets (T8100, T9100, T8200, T8300) contain a critical availability vulnerability allowing unauthenticated remote attackers to crash or disable modems over the network without user…

How to fix or mitigate CVE-2026-21553?

Within 24 hours, work with device vendors and internal teams to identify all systems running Unisoc T8100, T9100, T8200, or T8300 firmware and confirm which versions are vulnerable. Over the next 7 days, implement compensating controls by restricting network access to affected modems using firewall rules or network segmentation, and enable detailed logging on modem communications to detect suspicious patterns. Within 30 days, establish a monitoring cadence for Unisoc security advisories; when firmware patches are released, create a prioritized update plan beginning with production and customer-facing systems, completing full deployment within 60 days of patch availability.

Unisoc Modem CVE-2026-21553

EUVD-2026-52234 HIGH

Improper Input Validation (CWE-20)

2026-08-03 Unisoc

GHSA-m8m7-6fxv-m3w9

Denial Of Service T8100 T9100 T8200 T8300 Unisoc Shanghai Technologies Co Ltd

7.5

CVSS 3.1 · Vendor: Unisoc

Severity by source

Vendor (Unisoc) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable modem input flaw with no authentication or user interaction required; impact is purely availability loss with no confidentiality or integrity compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Unisoc).

CVSS VectorVendor: Unisoc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 08:23 vuln.today

CVE Published

Aug 03, 2026 - 07:18 cve.org

HIGH 7.5

DescriptionCVE.org

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

AnalysisAI

Remote denial of service in Unisoc T8100/T9100/T8200/T8300 modem firmware allows unauthenticated remote attackers to crash or render the modem inoperable through crafted network input. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms exploitation requires no authentication, no user interaction, and low complexity, making any exposed device potentially reachable. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low barrier to exploitation warrants prompt firmware patching.

Technical ContextAI

The affected components are the modem subsystems embedded in Unisoc (Shanghai) Technologies T8100, T9100, T8200, and T8300 chipsets, identified via CPE cpe:2.3:a:unisoc_(shanghai)_technologies_co.,_ltd.:t8100/t9100/t8200/t8300. These are system-on-chip (SoC) modem processors used in budget and mid-range Android devices, primarily deployed in emerging markets. The flaw is an improper input validation defect - characteristic of CWE-20 - in the modem's handling of externally supplied network data (e.g., radio-layer or protocol-stack packets). Failure to validate input before processing allows a malformed message to trigger abnormal modem state, resulting in a denial of service. The CWE field in the NVD entry is absent, preventing precise root-cause classification beyond what the description implies.

RemediationAI

The primary remediation is to apply modem firmware updates distributed by device OEMs incorporating the fix from Unisoc's security bulletin (https://www.unisoc.com/en/support/product-security-bulletin/2084109408382668801). End users should check for over-the-air (OTA) system updates from their device manufacturer. An exact patched firmware version number is not independently confirmed from the available data - the Unisoc advisory should be consulted directly. If firmware updates are unavailable or delayed by the OEM, a compensating control is to restrict exposure to untrusted cellular networks where feasible, though this trades connectivity for protection. There are no documented workarounds short of a full firmware patch. Disabling the modem entirely would eliminate the attack surface but also eliminate cellular functionality, an impractical trade-off for most use cases.