critical · CVSS v3 9.8

CVE-2026-20557

A critical out-of-bounds write in Modem firmware allows remote privilege escalation when a UE connects to a rogue base station. The flaw can

Overview

A critical out-of-bounds write in Modem firmware allows remote privilege escalation when a UE connects to a rogue base station. The flaw can be exploited without user interaction, enabling attackers to gain elevated privileges on the device.

Description

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01877236; Issue ID: MSV-9804.

Impact

Confidentiality: attacker can read or modify sensitive data on the device. Integrity: attacker can alter firmware or configuration. Availability: potential for device lock‑out or denial of service. The primary impact is on mobile network operators and end‑users whose devices run the vulnerable firmware.

Remediation

Apply the vendor’s patch (Patch ID MOLY01877236) to the modem firmware. If a patch is unavailable, disable or restrict the modem’s ability to connect to unknown base stations and enforce strict base‑station authentication. Monitor for anomalous base‑station connections.

Risk context

Severity is critical with a CVSS v3 score of 9.8, indicating a high urgency for remediation.

Affected products

  • Modem firmware

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

out-of-bounds privilege-escalation modem critical remote-exploit

← All CVEs

Related CVEs

critical

CVE-2026-120344

A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

View analysis

critical

CVE-2026-20499

CVE-2026-20499 is a critical out-of-bounds write in modem firmware that can allow remote privilege escalation when a user equipment connects to a rogue base station. The flaw requires no user interaction and can be exploited by an attacker controlling a base station. A patch (MOLY01857954) is available to fix the missing bounds check.

View analysis

critical

CVE-2026-20545

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.

View analysis

critical

CVE-2026-20546

In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803.

View analysis