critical · CVSS v3 9.8

CVE-2026-20554

CVE-2026-20554 is a critical flaw in modem firmware that can cause a system crash due to a missing bounds check. The vulnerability allows re

Overview

CVE-2026-20554 is a critical flaw in modem firmware that can cause a system crash due to a missing bounds check. The vulnerability allows remote privilege escalation when a user equipment (UE) connects to a rogue base station, requiring user interaction. It can lead to loss of confidentiality, integrity, and availability of the device.

Description

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01911177; Issue ID: MSV-10122.

Impact

The flaw can crash the modem, potentially exposing sensitive data and allowing attackers to gain elevated privileges on the device. Network operators and end‑users of affected modems are at risk, as the attack requires a UE to connect to a malicious base station.

Remediation

Apply the vendor’s firmware patch (Patch ID: MOLY01911177) to address the bounds check issue. Verify firmware version after update, disable or block connections to untrusted base stations, and monitor for anomalous base station activity.

Risk context

Severity is critical with a CVSS v3 score of 9.8. No EPSS data is available, but the high score indicates a high likelihood of exploitation if left unpatched.

Affected products

  • Modem

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.8
CVSS v4
—
EPSS
—

critical privilege escalation modem bounds check remote system crash UE patch

← All CVEs

Related CVEs

critical

CVE-2026-120344

A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

View analysis

critical

CVE-2026-20499

CVE-2026-20499 is a critical out-of-bounds write in modem firmware that can allow remote privilege escalation when a user equipment connects to a rogue base station. The flaw requires no user interaction and can be exploited by an attacker controlling a base station. A patch (MOLY01857954) is available to fix the missing bounds check.

View analysis

critical

CVE-2026-20545

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.

View analysis

critical

CVE-2026-20546

In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803.

View analysis