CVE-2026-66085
Received Received - Intake

Unfiltered Sensitive Data Exposure in Modem Crash Dumps

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Unisoc

Description
In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-66085
EUVD
EUVD-2026-97141

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Unisoc (Shanghai) Technologies Co., Ltd. Modem T8100
Unisoc (Shanghai) Technologies Co., Ltd. Modem T9100
Unisoc (Shanghai) Technologies Co., Ltd. Modem T8300

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in the modem component of certain chipsets. It occurs because crash dumps are not properly filtering sensitive data, which could allow local attackers to access confidential information without needing additional execution privileges.

Detection Guidance

This vulnerability involves missing filtering of sensitive data in modem crash dumps. To detect it, check for crash dump files in modem logs or directories like /data/dumpstate/ or /sys/module/modem/. Look for files containing sensitive information such as IMEI, IMSI, or call logs. Use commands like 'find / -name '*crash*' -type f' or 'ls -l /data/dumpstate/' to locate potential dump files. Review these files for exposed sensitive data.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to your device to read sensitive information stored in crash dumps, such as personal data or credentials. No special permissions are required beyond local access.

Compliance Impact

This vulnerability could lead to local information disclosure by exposing sensitive data in crash dumps. For GDPR, this may violate data protection principles if personal data is exposed. For HIPAA, it could risk unauthorized access to protected health information if such data is present in the modem's crash dumps.

Mitigation Strategies

Check if your device uses affected Unisoc chipsets (T8100, T9100, T8300). Update modem firmware to the latest version provided by Unisoc or your device manufacturer to address the missing filtering in crash dumps.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66085. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart