CVE-2026-20460
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Modem module, there is a vulnerability leading to information disclosure due to improper input validation. An attacker can remotely disclose information if the user equipment (UE) connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are required for exploitation.
Risk Assessment
The risk involves potential remote leakage of sensitive data from the mobile device without user awareness, which could compromise privacy and communication security.
Recommendation
It is recommended to immediately apply patch MOLY01811421 provided by the vendor and avoid connecting to untrusted base stations.
Other vulnerabilities in Modem
See all- CVE-2026-21555High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21554High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21553High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21552High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21551High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21550High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21549High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-20479High
In Modem, a missing bounds check could lead to an out-of-bounds read, allowing remote denial of service if the UE connects to a rogue base station controlled by the attacker. No additional privileges or user interaction are needed.
- CVE-2026-20463Medium
In the Modem module, a vulnerability was found that allows privilege escalation through a permissions bypass. This can be exploited locally if the attacker already has System privileges. User interaction is not required for exploitation.
- CVE-2026-20461Medium
In the Modem module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
Original NVD description (English source)
In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01811421; Issue ID: MSV-6788.