high · CVSS v3 7.5

CVE-2026-20560

CVE-2026-20560 causes a modem crash due to improper input validation when a UE connects to a rogue base station. The flaw can trigger a remo

Overview

CVE-2026-20560 causes a modem crash due to improper input validation when a UE connects to a rogue base station. The flaw can trigger a remote denial‑of‑service without user interaction or elevated privileges. It affects devices that rely on the vulnerable modem firmware.

Description

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01870543; Issue ID: MSV-9070.

Impact

The vulnerability leads to a loss of availability for the affected modem, disrupting network connectivity. Confidentiality and integrity remain intact, but the denial of service can impact network operators, device manufacturers, and end users. No privileged access is required, making it easier for attackers to exploit.

Remediation

Apply the vendor‑issued patch MOLY01870543 to update the modem firmware. Verify that input validation is correctly implemented and monitor for abnormal crash logs. If a patch is unavailable, isolate the device from the network until remediation is applied.

Risk context

Severity is high with a CVSS v3 score of 7.5. No EPSS data is available, but the lack of user interaction and the remote nature of the exploit warrant prompt action.

Affected products

  • Modem

Scores

Severity
high
CVSS v2
5
CVSS v3
7.5
CVSS v4
—
EPSS
—

Denial of Service Remote Input Validation High Severity CVE-2026-20560

← All CVEs

Related CVEs

high

CVE-2026-120342

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-20552

CVE-2026-20552 is an out-of-bounds write vulnerability in the ccci component of MediaTek firmware. It can cause a remote denial-of-service when a user interacts with the affected device. The flaw requires no elevated privileges and is mitigated by applying the vendor patch.

View analysis

high

CVE-2026-20555

CVE-2026-20555 is an out‑of‑bounds read in modem firmware that can cause a remote denial of service when a user equipment (UE) connects to a rogue base station. The flaw requires no user interaction or elevated privileges and can be triggered by an attacker controlling the base station. Affected devices can become unresponsive, disrupting connectivity for users.

View analysis

high

CVE-2026-20558

CVE-2026-20558 is a local privilege escalation vulnerability in the GPU pdma component caused by a use‑after‑free bug. It allows an attacker with local access to gain higher privileges on the affected system without additional execution privileges. The flaw exists in the Windows GPU driver and requires no user interaction.

View analysis