Denial of Service Vulnerability in Modem by MediaTek
CVE-2026-20404

6.5MEDIUM

Key Information:

Vendor

MediaTek
Status
Mt2735, Mt2737, Mt6813, Mt6815, Mt6833, Mt6835, Mt6853, Mt6855, Mt6858, Mt6873, Mt6875, Mt6877, Mt6878, Mt6879, Mt6880, Mt6883, Mt6885, Mt6886, Mt6889, Mt6890, Mt6891, Mt6893, Mt6895, Mt6896, Mt6897, Mt6899, Mt6980, Mt6983, Mt6985, Mt6986, Mt6989, Mt6990, Mt6991, Mt6993, Mt8668, Mt8673, Mt8675, Mt8676, Mt8678, Mt8755, Mt8771, Mt8791, Mt8791t, Mt8792, Mt8793, Mt8795t, Mt8797, Mt8798, Mt8863, Mt8873, Mt8883, Mt8893
Vendor
CVE Published:
2 February 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-20404?

In MediaTek's modem, a security flaw exists due to insufficient input validation, which could allow attackers to induce a system crash. This vulnerability particularly arises when a User Equipment (UE) connects to a maliciously controlled rogue base station. Notably, the exploitation of this flaw does not require any user interaction nor elevated execution privileges, making it critical for users to ensure their devices are updated to versions that incorporate the necessary security patches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6983, MT6985, MT6986, MT6989, MT6990, MT6991, MT6993, MT8668, MT8673, MT8675, MT8676, MT8678, MT8755, MT8771, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893 Modem NR15 , NR16 , NR17 , NR17R

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-20404-MediaTek-modem-remote-DoS-rogue-base-station-scenario-
Created by George0Papasotiriou

References

https://corp.mediatek.com/product-security-bulletin/Febru...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.