CVE-2026-20403

7.5 HIGH
Denial of Service

📋 TL;DR

This vulnerability in MediaTek modems allows remote denial of service via system crash when a device connects to a malicious base station. Attackers can trigger this without user interaction or special privileges. Affects devices using specific MediaTek modem firmware versions.

💻 Affected Systems

Products:
  • MediaTek modem chipsets
Versions: N15, NR16, NR17, NR17R firmware versions
Operating Systems: Android and other OS using affected MediaTek modems
Default Config Vulnerable: ⚠️ Yes
Notes: Affects devices with specific MediaTek modem firmware; exact device models depend on manufacturer implementations.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Permanent device bricking requiring hardware replacement, though temporary crash is more likely.

🟠

Likely Case

Device reboot or temporary service disruption until manual restart.

🟢

If Mitigated

No impact if patched or if device cannot connect to rogue base stations.

🌐 Internet-Facing: MEDIUM - Requires proximity to rogue base station but no authentication needed.
🏢 Internal Only: LOW - Typically requires physical proximity to affected device.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Requires setting up rogue base station with specific malicious signals; technical but feasible for determined attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches: MOLY01689254 (N15/NR16), MOLY01689259 (NR17/NR17R)

Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/February-2026

Restart Required: Yes

Instructions:

1. Check device manufacturer for firmware updates. 2. Apply modem firmware patch from manufacturer. 3. Reboot device after update.

🔧 Temporary Workarounds

Disable automatic network selection

all

Manually select trusted networks to prevent connection to rogue base stations

Settings vary by device; typically in Network & Internet > Mobile network settings

Enable airplane mode in untrusted areas

all

Temporarily disable cellular radio when in high-risk locations

Quick settings toggle or Settings > Network & Internet > Airplane mode

🧯 If You Can't Patch

  • Restrict device usage to trusted cellular networks only
  • Deploy physical security measures to prevent unauthorized base stations in sensitive areas

🔍 How to Verify

Check if Vulnerable:

Check modem firmware version via device settings or manufacturer tools; compare against patched versions.

Check Version:

Device-specific; typically in Settings > About phone > Baseband version or similar

Verify Fix Applied:

Verify modem firmware version matches patched versions MOLY01689254 or MOLY01689259.

📡 Detection & Monitoring

Log Indicators:

  • Unexpected modem crashes
  • Base station connection errors
  • System reboot events

Network Indicators:

  • Connections to unknown base stations
  • Unusual signal patterns

SIEM Query:

EventID: System crash OR Modem error OR Baseband failure near rogue tower locations

📊 Metadata

CVE ID: CVE-2026-20403
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-787
Published: February 2, 2026
Last Updated: February 4, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share This