CVE-2026-20577

Received Received - Intake

Permission Bypass in Modem Leads to Local DoS

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: MediaTek, Inc.

Description

In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01880753; Issue ID: MSV-9866.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-02

Last Modified

2026-11-02

Generated

2026-11-02

AI Q&A

2026-11-02

EPSS Evaluated

N/A

NVD

CVE-2026-20577

Affected Vendors & Products

Vendor	Product	Version / Range
MediaTek, Inc.	MediaTek chipset	MT2716
MediaTek, Inc.	MediaTek chipset	MT6813
MediaTek, Inc.	MediaTek chipset	MT6815
MediaTek, Inc.	MediaTek chipset	MT6835
MediaTek, Inc.	MediaTek chipset	MT6858
MediaTek, Inc.	MediaTek chipset	MT6878
MediaTek, Inc.	MediaTek chipset	MT6881
MediaTek, Inc.	MediaTek chipset	MT6897
MediaTek, Inc.	MediaTek chipset	MT6899
MediaTek, Inc.	MediaTek chipset	MT6982
MediaTek, Inc.	MediaTek chipset	MT6986
MediaTek, Inc.	MediaTek chipset	MT6988
MediaTek, Inc.	MediaTek chipset	MT6991
MediaTek, Inc.	MediaTek chipset	MT6993
MediaTek, Inc.	MediaTek chipset	MT8668
MediaTek, Inc.	MediaTek chipset	MT8676
MediaTek, Inc.	MediaTek chipset	MT8678
MediaTek, Inc.	MediaTek chipset	MT8755
MediaTek, Inc.	MediaTek chipset	MT8775
MediaTek, Inc.	MediaTek chipset	MT8792
MediaTek, Inc.	MediaTek chipset	MT8793
MediaTek, Inc.	MediaTek chipset	MT8863
MediaTek, Inc.	MediaTek chipset	MT8873
MediaTek, Inc.	MediaTek chipset	MT8875
MediaTek, Inc.	MediaTek chipset	MT8883

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-280	The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Attack-Flow Graph

Executive Summary

This vulnerability in Modem allows a malicious actor with System privilege to bypass permissions, potentially causing a local denial of service. Exploitation does not require user interaction.

Impact Analysis

If exploited, it could lead to a denial of service on your device, disrupting normal operations. However, the attacker must already have high-level System privileges to exploit this.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. The description focuses on a local denial of service due to permission bypass in MediaTek chipsets, but lacks details on regulatory impacts.

Mitigation Strategies

Apply the patch identified as MOLY01880753 to address the permission bypass issue. Ensure the System privilege is properly configured to prevent local denial of service.

Hi! I’m here to help you understand CVE-2026-20577. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...

Permission Bypass in Modem Leads to Local DoS

Description

CVSS Scores

EPSS Scores

Meta Information

Affected Vendors & Products

Helpful Resources

Exploitability

Attack-Flow Graph

AI Quick Actions

Chat Assistant

EPSS Chart

Security Radar