CVE-2026-20460: Modem Information Disclosure via Rogue Base Station Attack

Technical summary

CVE-2026-20460 is an information disclosure vulnerability in modem firmware caused by insufficient input validation. The vulnerability is triggered when a User Equipment (UE) associates with a rogue base station; the modem fails to properly validate incoming network data, allowing the attacker to extract sensitive information. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates an adjacent-network attack vector with high attack complexity, no privilege requirement, no user interaction needed, confidentiality impact rated high, and no integrity or availability impact. The root cause is mapped to CWE-288 (Authentication Bypass Using an Alternate Path or Channel).

Business impact

Information disclosure through a compromised base station connection can result in exposure of user credentials, authentication tokens, personal identifiable information, or proprietary business data transmitted over cellular connections. For organizations with employees in areas where rogue base stations may be deployed—such as airports, hotels, or regions with limited network oversight—this vulnerability increases the risk of targeted credential theft and data exfiltration. The lack of user interaction requirement means employees cannot mitigate risk through cautious behavior; protective measures must be device-level.

Affected systems

Specific vendor and product names are not disclosed in the source advisory. Organizations should cross-reference the Patch ID (MOLY01811421) and Issue ID (MSV-6788) with their modem manufacturers' security bulletins to identify affected device models and firmware versions. Any modem with vulnerable firmware matching this issue ID should be considered in scope for remediation.

Exploitability

Exploitation requires an attacker to control a rogue base station within wireless range of target devices. Once a UE connects, no additional actions or credentials are needed; information disclosure occurs passively. Attack complexity is rated high, likely because successful exploitation depends on factors such as proximity, base station signal strength, and the specific data accessible during the connection. This is not an easy-to-exploit vulnerability requiring specialized equipment and operational effort, but it poses a significant risk to users in targeted environments or during advanced persistent threat operations.

Remediation

Patch the affected modem firmware immediately using the vendor's security update corresponding to Patch ID MOLY01811421. Verify that the patched firmware version has been pushed to all affected devices in your fleet. Device manufacturers should confirm that the fix addresses MSV-6788. Test updated modems in your environment before broad deployment to ensure compatibility with existing infrastructure.

Patch guidance

Contact your modem vendor directly to obtain the firmware update associated with Patch ID MOLY01811421. Firmware updates for modems are typically delivered over-the-air (OTA) or through vendor management platforms. Prioritize applying patches to devices used in high-risk environments or by high-value users. Verify patch installation by confirming firmware version numbers match the vendor's security bulletin. Organizations should not delay patching; the vulnerability is remotely triggerable and poses an ongoing risk to any device on an untrusted network.

Detection guidance

Monitor modem firmware versions in your device inventory to ensure all units have been updated to patched versions. Network intrusion detection systems may identify rogue base station behavior through anomalous signaling patterns or unexpected base station parameters. Implement network segmentation to reduce the sensitivity of data accessible from compromised cellular connections. Endpoint detection and response (EDR) tools on devices connected via affected modems should monitor for unusual credential usage or data exfiltration that may indicate successful exploitation. Passive monitoring of modem logs (where available) may reveal suspicious or malformed network inputs.

Why prioritize this

Although rated MEDIUM severity by CVSS score, this vulnerability merits prioritization due to its remote, user-interaction-free exploitation path and the high confidentiality impact. Information disclosure vulnerabilities are often underestimated but can serve as a foundation for follow-on attacks such as credential theft or lateral movement. The adjacent-network requirement (rogue base station) is surmountable in targeted scenarios or espionage campaigns, making this a credible threat for government, enterprise, and high-profile users.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects the technical attack requirements: adjacent-network access is needed (AV:A), attack complexity is high (AC:H), and the impact is limited to confidentiality (C:H, I:N, A:N). The score does not account for operational factors such as targeted use against specific individuals or organizations, the reusable nature of rogue base station attacks, or the difficulty of detecting exploitation. Security leaders should evaluate contextual risk based on user populations, geographic exposure, and data sensitivity.

Frequently asked questions