CVE-2026-20600
Received
Received - Intake
Modem Logic Error Leads to Remote DoS
Vulnerability report for CVE-2026-20600, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-02
Last updated on: 2026-11-02
Assigner: MediaTek, Inc.
Description
Description
In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01416152; Issue ID: MSV-7924.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| MediaTek, Inc. | MediaTek chipset | MT2716 |
| MediaTek, Inc. | MediaTek chipset | MT6835 |
| MediaTek, Inc. | MediaTek chipset | MT6858 |
| MediaTek, Inc. | MediaTek chipset | MT6878 |
| MediaTek, Inc. | MediaTek chipset | MT6881 |
| MediaTek, Inc. | MediaTek chipset | MT6897 |
| MediaTek, Inc. | MediaTek chipset | MT6899 |
| MediaTek, Inc. | MediaTek chipset | MT6982 |
| MediaTek, Inc. | MediaTek chipset | MT6986 |
| MediaTek, Inc. | MediaTek chipset | MT6988 |
| MediaTek, Inc. | MediaTek chipset | MT6991 |
| MediaTek, Inc. | MediaTek chipset | MT6993 |
| MediaTek, Inc. | MediaTek chipset | MT8668 |
| MediaTek, Inc. | MediaTek chipset | MT8676 |
| MediaTek, Inc. | MediaTek chipset | MT8678 |
| MediaTek, Inc. | MediaTek chipset | MT8755 |
| MediaTek, Inc. | MediaTek chipset | MT8775 |
| MediaTek, Inc. | MediaTek chipset | MT8792 |
| MediaTek, Inc. | MediaTek chipset | MT8793 |
| MediaTek, Inc. | MediaTek chipset | MT8863 |
| MediaTek, Inc. | MediaTek chipset | MT8873 |
| MediaTek, Inc. | MediaTek chipset | MT8875 |
| MediaTek, Inc. | MediaTek chipset | MT8883 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-617 | The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. |
