What is the CVSS score of EUVD-2026-52235?

EUVD-2026-52235 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Unisoc UDX710 are affected by EUVD-2026-52235?

The Unisoc UDX710 modem is vulnerable to a remote denial-of-service attack (CVE-2026-21554) that allows unauthenticated attackers to crash or disable modem functionality, creating potential service…

How to fix or mitigate EUVD-2026-52235?

Within 24 hours, inventory all Unisoc UDX710 modems in production and assess their network accessibility, prioritizing devices exposed to external networks. Within 7 days, implement network segmentation to restrict modem access to trusted networks only, deploy rate limiting or intrusion prevention controls on paths to the device, and disable remote management protocols if operationally feasible. Within 30 days, establish contact with Unisoc to track patch availability, document the security posture of any interim controls, and evaluate replacement with alternative modem vendors offering active security support.

Unisoc UDX710 EUVD-2026-52235

| CVE-2026-21554 HIGH

Improper Input Validation (CWE-20)

2026-08-03 Unisoc

GHSA-7wxg-9g2j-2fmv

Denial Of Service Udx710 Unisoc Shanghai Technologies Co Ltd

7.5

CVSS 3.1 · Vendor: Unisoc

Severity by source

Vendor (Unisoc) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Modem input is network-reachable with no auth or interaction required; impact is availability-only crash with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Unisoc).

CVSS VectorVendor: Unisoc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 08:22 vuln.today

CVE Published

Aug 03, 2026 - 07:18 cve.org

HIGH 7.5

DescriptionCVE.org

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed

AnalysisAI

Remote denial of service in the Unisoc UDX710 modem allows unauthenticated remote attackers to crash or disable modem functionality by sending crafted network input that bypasses input validation in the baseband stack. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no elevated privileges - only network-reachable access to the modem. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

The UDX710 is a Unisoc (Shanghai) Technologies baseband modem chipset found in budget and mid-range Android devices, primarily sold in Asian and emerging markets. As identified in CPE cpe:2.3:a:unisoc_(shanghai)_technologies_co.,_ltd.:udx710:*:*:*:*:*:*:*:*, the wildcard version fields indicate the full affected version range is unspecified in NVD data. The vulnerability resides in the modem's network-facing input processing layer, where malformed or unexpected protocol data is not adequately validated before being processed. Although CWE is listed as N/A by NVD, the description explicitly states 'improper input validation,' mapping functionally to CWE-20. Modem baseband vulnerabilities are of particular concern because the radio stack operates largely independently of the Android OS security model and may be reachable directly from the cellular network without passing through the operating system's packet filters.

RemediationAI

Apply the security update detailed in the Unisoc product security bulletin at https://www.unisoc.com/en/support/product-security-bulletin/2084109408382668801. Exact patched firmware version numbers are not specified in the available data and have not been independently confirmed. Because the UDX710 is an OEM-integrated chipset, end-users must await device-specific firmware updates from their handset manufacturer, which may introduce additional delay beyond Unisoc's internal patch. For enterprise or fleet deployments where patching is delayed, a practical compensating control is to disable mobile data and restrict devices to Wi-Fi only, which removes the network attack vector at the cost of cellular connectivity. Monitoring for abnormal modem resets or connectivity dropouts may aid in detecting exploitation attempts. There are no known software-level workarounds that preserve full modem functionality while mitigating the flaw.