What is the CVSS score of EUVD-2026-52220?

EUVD-2026-52220 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Unisoc UDX710 are affected by EUVD-2026-52220?

The Unisoc UDX710 modem component contains a remote denial-of-service vulnerability that disables cellular connectivity on affected devices without requiring authentication or user action.

How to fix or mitigate EUVD-2026-52220?

Within 24 hours, complete an inventory of all devices and products in your deployed infrastructure containing the Unisoc UDX710 modem component and classify them by criticality and network exposure. Within 7 days, implement network-layer traffic filtering and monitoring to detect malformed input patterns targeting the modem, restrict network access to affected devices to trusted sources only, and move mission-critical affected systems to protected network segments with limited external connectivity. Within 30 days, initiate direct contact with your device vendors and Unisoc for patch status and timeline; develop and document a staged upgrade or replacement plan keyed to patch availability; and if no patch timeline is provided by end of Q3 2026, evaluate alternative modem suppliers for future device procurement to reduce long-term exposure.

Unisoc UDX710 EUVD-2026-52220

| CVE-2026-21555 HIGH

Improper Input Validation (CWE-20)

2026-08-03 Unisoc

GHSA-39c3-6p4j-vwgv

Denial Of Service Udx710 Unisoc Shanghai Technologies Co Ltd

7.5

CVSS 3.1 · Vendor: Unisoc

Severity by source

Vendor (Unisoc) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable modem input with no auth or user interaction required; impact is purely availability, no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Unisoc).

CVSS VectorVendor: Unisoc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 08:21 vuln.today

CVE Published

Aug 03, 2026 - 07:18 cve.org

HIGH 7.5

DescriptionCVE.org

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

AnalysisAI

Remote denial of service in the Unisoc UDX710 modem allows a network-adjacent or remote attacker to crash the modem subsystem of affected devices by sending malformed or crafted input that bypasses input validation. The vulnerability requires no authentication and no user interaction, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is limited to availability - there is no confidentiality or integrity exposure - but a successful attack would disrupt cellular connectivity on the affected device. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

The affected component is the modem firmware of the Unisoc UDX710 chipset (CPE: cpe:2.3:a:unisoc_(shanghai)_technologies_co.,_ltd.:udx710:*:*:*:*:*:*:*:*), a mobile processor produced by Unisoc (Shanghai) Technologies Co., Ltd. and used primarily in budget and mid-range Android smartphones. The root cause is improper input validation in the modem stack - a classic logic flaw where externally supplied network data (such as malformed protocol messages received over the air) is not correctly sanitized before processing, causing an unhandled error condition that leads to a denial-of-service outcome. No CWE identifier was assigned in the advisory, but the description 'improper input validation' maps closely to CWE-20. The wildcard CPE version field indicates Unisoc has not published granular version scoping in public NVD data.

RemediationAI

The primary remediation is to apply the vendor-released patch referenced in Unisoc's product security bulletin at https://www.unisoc.com/en/support/product-security-bulletin/2084109408382668801. A specific patched firmware or software version was not confirmed in available data - contact Unisoc directly or consult the OEM device manufacturer's security update channel to obtain the exact fixed version for a given device SKU. As a compensating control, disabling cellular data or restricting modem exposure on affected devices limits the attack surface, though this trades off connectivity. For enterprise-managed fleets (e.g., MDM-enrolled devices), prioritize firmware update deployment and monitor for unexpected modem resets as an exploitation indicator. No patch version number can be cited from the provided data, so firmware update applicability should be verified directly with the OEM.