CVE-2026-20504
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In the Modem module, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
Risk Assessment
An attacker can remotely cause a system crash, leading to service disruption for network users.
Recommendation
Apply the vendor patch MOLY00755024 (Issue ID: MSV-7865) to fix the missing bounds check.
Other vulnerabilities in Modem
See all- CVE-2026-57008High
In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20503Medium
In the Modem module, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
- CVE-2026-20500Medium
In the Modem module, there is a possible system crash due to improper input validation. This could lead to local denial of service, but requires user execution privileges and user interaction.
- CVE-2026-21555High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21554High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21553High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21552High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21551High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21550High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
- CVE-2026-21549High
In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.
Original NVD description (English source)
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00755024; Issue ID: MSV-7865.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

