CVE-2026-20577
MediumCVSS 4.4Summary
In the Modem component, there is a permission bypass vulnerability. It could lead to local denial of service by an actor who already has System privileges.
Risk Assessment
A local attacker with System privileges could bypass permission mechanisms and cause denial of service. Exploitation does not require user interaction.
Recommendation
Deploy patch MOLY01880753. Review permission control mechanisms in the Modem module.
Other vulnerabilities in Modem
See all- CVE-2026-68591Medium
In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
- CVE-2026-68589Medium
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
- CVE-2026-68588Medium
In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20600Medium
In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20599Medium
In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation.
- CVE-2026-20598Medium
In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-20597Medium
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
- CVE-2026-20596Medium
In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
- CVE-2026-20594Medium
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
- CVE-2026-20593Medium
In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service if a UE has connected to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed for exploitation.
Original NVD description (English source)
In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01880753; Issue ID: MSV-9866.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS