Cpe:2.3:a:*:modem:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amodem/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 17:50:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgModem: Out-of-bounds write vulnerability (CVE-2026-20499)https://feed.craftedsignal.io/briefs/2026-11-modem-oob-write/Mon, 02 Nov 2026 17:50:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-modem-oob-write/A missing bounds check in Modem firmware allows an attacker operating a rogue base station to execute an out-of-bounds write, leading to remote privilege escalation without user interaction.CVE-2026-20499 is a memory corruption vulnerability in Modem firmware identified by the lack of bounds checking. The vulnerability allows for remote privilege escalation when a User Equipment (UE) device connects to a rogue base station controlled by an attacker. The vulnerability (MSV-8247) is addressed by Patch ID MOLY01857954.

Impact

An attacker can achieve remote privilege escalation on a target device without user interaction or prior elevated execution privileges by forcing the device to connect to a malicious base station.

Recommendation

  • Verify the current firmware version of all cellular-connected UEs in the environment.
  • Apply patch MOLY01857954 (Issue MSV-8247) to all affected Modem hardware.
  • Implement cellular network monitoring to identify anomalies in base station parameters or signal strength characteristics that may indicate rogue base station activity.
]]>highadvisory