CVE-2026-20459: Modem Denial of Service via Rogue Base Station Attack

Technical summary

CVE-2026-20459 is an improper input validation flaw in modem firmware that triggers a denial-of-service condition. When a UE (User Equipment) connects to an attacker-controlled base station, a crafted signal or protocol message causes the modem to crash due to insufficient bounds checking or input sanitization. The attack vector is adjacent (AV:A), reflecting the requirement to operate or control network infrastructure, though access is not difficult. The attack complexity is high (AC:H), suggesting specific conditions must align. No authentication, user action, or elevated privileges are needed once the UE associates with the rogue base station. CVSS 3.1 score of 5.3 reflects a medium-severity availability impact with no confidentiality or integrity loss.

Business impact

Organizations operating or supporting mobile devices are at risk of service disruption if employees or customers connect to compromised cellular networks. While the modem crash is recoverable via restart, it can disrupt communications, productivity, and real-time operations. The risk is moderate because the attack requires the attacker to control radio infrastructure—a higher barrier than direct internet access—and does not lead to data exfiltration or persistent compromise.

Affected systems

The vulnerability resides in modem firmware and affects devices that run the affected modem software. The advisory does not specify individual device models, OEMs, or OS platforms; you must cross-reference the patch details (MOLY01816800, MSV-6842) with your vendor's security notices to determine which phones, tablets, or embedded systems are impacted. Check with your device manufacturer or cellular chipset supplier for detailed product scope.

Exploitability

Exploitation requires an attacker to operate a rogue base station—a high-cost, high-complexity setup. However, once deployed in a target area, the attack is reliable and requires no user interaction or credentials. The victim merely needs to be in range and allow the device to connect to the network. This makes the vulnerability exploitable in targeted scenarios (e.g., near sensitive facilities or high-value targets) but unlikely to be mass-exploited unless an attacker has significant resources and motivation.

Remediation

Apply the available patch (Patch ID: MOLY01816800) to your modem firmware. Coordinate with your device OEM or carrier to obtain and deploy the update. For devices unable to receive patches, consider network-level mitigations such as Rogue Base Station Detection (RBSD) or monitoring for sudden modem resets in your mobile fleet. Ensure your organization's incident response plan includes procedures for modem crashes attributed to network anomalies.

Patch guidance

Identify your modem chipset and device model, then consult your manufacturer's security advisory for Patch ID MOLY01816800. Patch availability and deployment timelines vary by OEM and carrier; some devices may receive updates via over-the-air (OTA) mechanisms, while others may require manual intervention or carrier coordination. Prioritize patching devices in high-risk roles (executives, field operatives) or those frequently in untrusted network environments. Verify the patch application by confirming the Issue ID MSV-6842 is resolved in your firmware version, per your vendor's documentation.

Detection guidance

Monitor for unexplained modem resets or dropped cellular connections, especially if they occur in clusters or specific geographic areas. Correlate modem restart logs with network signal anomalies or reports of rogue base station activity. If your organization uses Mobile Threat Defense (MTD) solutions, enable algorithms to detect suspicious base station behavior. Track firmware versions across your fleet to ensure patched builds are deployed; device management tools can facilitate this inventory.

Why prioritize this

This vulnerability merits medium priority attention. Although the CVSS score of 5.3 is moderate, the practical barrier to exploitation—requiring attacker control of cellular infrastructure—reduces urgency compared to remotely exploitable flaws. However, the lack of user interaction and the availability impact make it a candidate for rapid patching in high-risk environments such as government, finance, or healthcare where communications reliability is critical.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) reflects the combination of high availability impact (A:H) against a backdrop of limited attack surface (AV:A, AC:H) and no confidentiality or integrity exposure (C:N, I:N). The adjacent attack vector acknowledges that radio-based attacks are generally harder to execute than internet-based ones, yet the absence of user interaction (UI:N) and authentication (PR:N) ensures the flaw remains a credible threat in targeted scenarios.

Frequently asked questions