MediaTek Modem EUVD-2026-40873

Exploitation requires the attacker to physically operate a rogue cellular base station (fake eNodeB or gNB) within radio range of the target UE - this is the AV:A (Adjacent Network) constraint in the CVSS vector. The victim's UE must associate with this rogue base station as part of cellular network selection; this happens automatically and without user awareness (UI:N), but only if the rogue signal is strong enough to be selected over legitimate towers. AC:H confirms this is not a simple setup: deploying a rogue base station requires specialized hardware (SDR), software (e.g., srsRAN, OpenBTS), a cellular license or willingness to operate illegally, and physical proximity to the target. No special configuration on the victim device is required, and no authentication or privileges on the victim system are needed (PR:N). Exploitation is limited by: requirement for geographic proximity, non-default attacker infrastructure, and the attack being inherently targeted rather than scalable. Devices that do not connect to the affected modem's radio stack (e.g., Wi-Fi-only tablets using non-affected chipsets) are not vulnerable.

The CVSS 5.3 Medium score reflects a careful balance of constraining factors: AV:A (Adjacent Network) requires the attacker to operate a rogue base station in physical proximity to the victim, and AC:H (High Complexity) acknowledges the non-trivial operational requirements of deploying a fake cell tower. Despite these constraints, the C:H (High Confidentiality) impact indicates meaningful sensitive data can be exfiltrated - potentially including IMSI, IMEI, session keys, or call metadata depending on which modem protocol buffers are exposed. SSVC corroborates low urgency: Exploitation=none, Automatable=no (consistent with the manual effort required per target), Technical Impact=partial. No KEV listing and no public POC further reduce short-term risk. The primary real-world threat model is nation-state or law enforcement-grade actors with stingray/IMSI-catcher infrastructure, not opportunistic mass exploitation. The 67+ affected chipset models across many device generations represent a broad but non-trivially exploitable attack surface. SSVC 'Automatable: no' and 'Technical Impact: partial' partially conflict with the C:H CVSS metric - the partial impact designation likely reflects that the disclosure is bounded to modem-layer data rather than full device compromise.

An attacker deploys a portable rogue base station (software-defined radio with fake eNodeB/gNB software) in a location where the target's device is likely to be, such as a conference, border crossing, or government building. The victim's device passively connects to the rogue tower as part of normal cellular association without user awareness. The attacker then sends crafted, malformed protocol messages to the victim UE's modem; due to improper input validation (CWE-288), the modem processes and responds to these messages in a way that leaks sensitive modem-layer information back to the rogue base station. No public proof-of-concept exploit code exists at time of analysis.