critical · CVSS v3 9.8

CVE-2026-20556

CVE-2026-20556 is a critical out‑of‑bounds write in modem firmware that allows remote privilege escalation when a user equipment (UE) connec

Overview

CVE-2026-20556 is a critical out‑of‑bounds write in modem firmware that allows remote privilege escalation when a user equipment (UE) connects to a rogue base station. The flaw requires no user interaction and can be exploited by an attacker controlling a base station. It poses a serious risk to network integrity and confidentiality.

Description

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876662; Issue ID: MSV-9833.

Impact

The vulnerability can compromise confidentiality and integrity by allowing attackers to gain elevated privileges on the modem. This can lead to unauthorized access to network resources and potential data exfiltration. Network operators, device manufacturers, and end users are all impacted as the flaw is exploitable remotely without user interaction.

Remediation

Apply the vendor’s patch (Patch ID MOLY01876662) to update the modem firmware. Verify that firmware updates are signed and authenticated. Disable or block connections to untrusted base stations and monitor for anomalous base station activity.

Risk context

Severity is critical with a CVSS v3 score of 9.8, indicating a high urgency for remediation. No EPSS data is available, but the lack of user interaction makes the threat immediate.

Affected products

  • Modem firmware

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

privilege-escalation out-of-bounds remote critical modem base-station UE

← All CVEs

Related CVEs

critical

CVE-2026-120344

A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

View analysis

critical

CVE-2026-20499

CVE-2026-20499 is a critical out-of-bounds write in modem firmware that can allow remote privilege escalation when a user equipment connects to a rogue base station. The flaw requires no user interaction and can be exploited by an attacker controlling a base station. A patch (MOLY01857954) is available to fix the missing bounds check.

View analysis

critical

CVE-2026-20545

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.

View analysis

critical

CVE-2026-20546

In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803.

View analysis