CVE-2026-20435
Received Received - Intake
Information Disclosure in MediaTek Preloader Due to Logic Error

Publication date: 2026-03-02

Last updated on: 2026-03-03

Assigner: MediaTek, Inc.

Description
In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-02
Last Modified
2026-03-03
Generated
2026-06-16
AI Q&A
2026-03-02
EPSS Evaluated
2026-06-15
NVD
CVE-2026-20435
EUVD
EUVD-2026-9160
Affected Vendors & Products
Showing 9 associated CPEs
Vendor Product Version / Range
openwrt openwrt 21.02.0
linuxfoundation yocto 4.0
rdkcentral rdk-b 2022q3
google android 14.0
google android 15.0
rdkcentral rdk-b 2024q1
openwrt openwrt 23.05.0
zephyrproject zephyr 3.7.0
google android 16.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the preloader component where a logic error allows a possible read of device unique identifiers.

An attacker with physical access to the device can exploit this issue to disclose sensitive device information without needing any additional execution privileges or user interaction.

Impact Analysis

The vulnerability can lead to local information disclosure of device unique identifiers.

If an attacker gains physical access to your device, they could extract sensitive device information without requiring any special permissions or user actions.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

Since the vulnerability involves a logic error in the preloader that allows reading device unique identifiers with physical access, immediate mitigation steps include applying the provided patch identified as ALPS10607099.

Restrict physical access to the device to prevent exploitation, as no additional execution privileges or user interaction are needed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart