critical · CVSS v3 9.8

CVE-2026-20499

CVE-2026-20499 is a critical out-of-bounds write in modem firmware that can allow remote privilege escalation when a user equipment connects

Overview

CVE-2026-20499 is a critical out-of-bounds write in modem firmware that can allow remote privilege escalation when a user equipment connects to a rogue base station. The flaw requires no user interaction and can be exploited by an attacker controlling a base station. A patch (MOLY01857954) is available to fix the missing bounds check.

Description

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01857954; Issue ID: MSV-8247.

Impact

The vulnerability can compromise confidentiality by allowing attackers to gain privileged access, integrity by enabling unauthorized modifications to the device, and availability through potential denial of service. It primarily impacts users of affected modems, network operators, telecom equipment manufacturers, and device vendors.

Remediation

Apply the vendor-supplied patch (MOLY01857954) to the modem firmware. Update all affected devices to the latest firmware version. Disable or block connections to untrusted base stations and enforce strict authentication mechanisms.

Risk context

With a CVSS v3 score of 9.8 and classified as critical, this vulnerability poses a high risk. Immediate patching is recommended to prevent remote privilege escalation.

Affected products

  • Modem firmware
  • UE modem
  • Base station modem
  • Telecom modem
  • Mobile device modem

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

out-of-bounds privilege-escalation modem critical remote-exploit patch UE base-station

← All CVEs

Related CVEs

critical

CVE-2026-120279

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

View analysis

critical

CVE-2026-120276

WAVLINK WN536AX6-A routers are vulnerable to remote OS command injection via the Web Management Interface. The flaw lies in the handling of the group_name parameter in /bin/ioos. Attackers can execute arbitrary commands on the device.

View analysis

critical

CVE-2026-120277

A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

View analysis

critical

CVE-2026-120280

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

View analysis