EUVD-2026-97141
GHSA-8266-6xxj-jx88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privilege app context on device
-
ExploitAccess unfiltered modem crash dump
-
ImpactRead disclosed sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires an attacker to already have local, low-privilege code execution (e.g., an installed/malicious app or local process) on a device running an affected UNISOC modem/baseband, and the ability to reach modem crash-dump data that is written without filtering of sensitive fields. Limiting factors: no remote vector (AV:L), so prior device access is mandatory; PR:L means some local privilege/app context is needed though not root; no user interaction is required (UI:N); impact is confined to disclosure of sensitive data (C:H) with no integrity or availability effect. Affected firmware/chipset versions are not specified in the provided data, so applicability per device cannot be confirmed here. |
| Impact | This is a moderate-severity, locally-exploitable information disclosure flaw and NOT an urgent remote-exploitation priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is internally consistent with the description: local attack vector, low complexity, and low privileges required (PR:L), yielding high confidentiality impact but no integrity or availability impact - consistent with reading sensitive data from modem crash dumps. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no signal of active or probable exploitation; status is 'no public exploit identified at time of analysis.' The signals are coherent rather than conflicting - a genuine but contained local-only confidentiality issue typical of baseband/modem vendor security-bulletin findings. The main caveat is missing data: no EPSS/KEV/POC telemetry and no enumerated affected chipset versions or firmware builds, so precise fleet impact cannot be derived from the input alone. |
| Exploit ScenarioDerived | A malicious or compromised low-privilege application already present on a device using an affected UNISOC modem accesses modem crash-dump output that was written without filtering of sensitive data. Because crash dumps retain unredacted sensitive content, the attacker harvests that data locally without needing elevated privileges or user interaction. No public exploit code was identified, and exploitation requires prior local access to the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Information disclosure in UNISOC modem (baseband) firmware allows a local, low-privileged attacker to read sensitive data that is captured in modem crash dumps without filtering of sensitive fields. Exploitation requires the attacker to already have local code execution on an affected device - for example an installed malicious app or a local process with access to the dump - with no remote vector (AV:L, PR:L) and no user interaction (UI:N). Rated CVSS 5.5 with confidentiality-only impact, this is a moderate-severity local exposure rather than an urgent remote-exploitation priority; no public exploit code has been identified at time of analysis, and the specific affected firmware/chipset versions are not specified in the available data.
RemediationAI
No vendor-released patch version is identified in the provided data, so the primary action is to confirm status and obtain fixed firmware through the UNISOC product security bulletin (https://www.unisoc.com/en/support/product-security-bulletin/2109454821805424641) and the relevant device OEM's update channel; apply the corrected baseband image as soon as it is published and treat any version listed there as authoritative rather than assuming a fix level. Until fixed firmware is available, the most effective compensating control is to restrict access to modem crash-dump artifacts and dump-collection paths so that only privileged/system components can read them - for example by tightening SELinux/file-permission policy on the dump directory and removing dump access from third-party or low-privilege app contexts - with the trade-off that over-restricting these paths can break vendor diagnostics and support tooling. Reducing the scope of automatic crash-dump collection (or disabling it outside of active debugging) limits the exposure window, at the cost of losing field telemetry used for modem stability analysis. Minimizing the number of installed applications and revoking unnecessary permissions reduces the likelihood that a locally installed app can reach the dump, though it is not a substitute for the firmware fix, and because the vector is local-only there is no network control or WAF-style mitigation that meaningfully applies.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the modem (baseband) subsystem of UNISOC chipsets, an isolated processor complex that handles cellular protocol stacks (RIL/NAS/AS layers), SIM/identity management, and radio state, and that communicates with the application processor over shared memory and IPC channels. When the modem faults, it produces crash dumps for diagnostics; those dumps can contain raw memory regions holding sensitive material such as subscriber identifiers, authentication/keys material, call and location metadata, or internal stack state. The reported root cause is missing filtering (sanitization/redaction) of such sensitive fields before the dump is persisted or made retrievable, so any local actor who can reach the dump artifact - an app holding the relevant permissions, a local process, or someone with local access to the dump path - can extract it. The record is mapped to CWE-20 (Improper Input Validation), although the described behavior is closer in nature to improper sanitization/exposure of sensitive information (e.g. CWE-200/CWE-212); the CWE-20 assignment should be treated as the vendor/NVD mapping rather than a precise root-cause class. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms a local attack path requiring low privilege, no user interaction, and confidentiality-only impact with no integrity or availability effect. No CPE strings were provided, so exact chipset and firmware build ranges cannot be enumerated from this dataset.
Know when Unisoc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only access to modem crash dumps requires an on-device low-privilege context (AV:L, PR:L), is straightforward (AC:L), and discloses sensitive data only (C:H, I:N, A:N).
Primary rating from Vendor (unisoc).
CVSS VectorVendor: unisoc
DescriptionCVE.org
In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB