CVE-2026-20434
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an attacker to gain higher privileges on a device by exploiting a flaw in the modem, but it requires the victim to connect to a malicious base station set up by the attacker. User interaction is necessary for the attack to succeed, meaning the victim must unknowingly connect to the rogue network.
Technical Description
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY00782946; Issue ID: MSV-4135.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Mar 2, 2026
about 1 month ago
Last Modified
Mar 2, 2026
about 1 month ago
Vendor
mediatek
Product
lr12a
Related Vulnerabilities
This vulnerability allows an attacker with system privileges to gain even higher privileges on devices using the MediaTek NB-IoT SDK, potentially giving them more control over the system. The attacker does not need any user interaction to exploit this flaw, but they must already have access to the system.
This vulnerability allows an attacker to gain higher privileges on a device using MediaTek's software development kit, potentially letting them control the device without needing any special permissions. The attacker only needs to be nearby to exploit this flaw, and no user interaction is required.
This vulnerability allows an attacker to gain higher privileges on a device using the Mediatek nbiot SDK, potentially letting them execute unauthorized actions. While the attacker needs to have user access to the device, they do not need any interaction from the user to exploit this flaw.