CVE-2026-20525

Executive Summary

CVE-2026-20525 is a reachable-assertion (CWE-617) vulnerability in an unspecified modem component, reportedly tracked by MediaTek patch IDs MOLY01870473 / MOLY00814393 and issue MSV-9041. An attacker operating a rogue base station can crash the modem of any connected User Equipment (UE) by sending malformed input, resulting in a remote denial of service with no user interaction and no additional privileges required. Because the flaw resides in baseband firmware, affected devices are those containing the vulnerable modem — the exact product list has not been published in the data available for this report, and no CVSS score or EPSS estimate has been assigned by NVD or FIRST.org.

Technical Analysis

The vulnerability is classified by the NVD as improper input validation leading to a possible system crash, and mapped to CWE-617 (Reachable Assertion). In baseband/modem engineering terms, a reachable assertion means a defensive assert or invariant check inside modem firmware is triggered by attacker-controlled input that the parser did not properly validate, causing the modem subsystem to abort and restart. The CNA issue identifier MSV-9041 and patch identifiers MOLY01870473 / MOLY00814393 are consistent with MediaTek modem (MOLY) vulnerability-handling conventions.

Key technical facts that can be stated without extrapolation:

• Attack vector: adjacent network / radio. The attacker must control or impersonate a base station and the victim UE must attach to it. The CVSS base metric has not been published, but the description's precondition ("if a UE has connected to a rogue base station controlled by the attacker") justifies treating this as an adjacent-network (AV:A) attack.
• Authentication and privileges: none required (PR:N). The rogue base station is the attack platform; no credentials on the UE are needed.
• User interaction: none (UI:N). The UE performs normal cell selection/reselection and network signaling automatically.
• Impact: availability only. The description specifies a "possible system crash," i.e., modem/stack termination. No confidentiality or integrity impact is described.
• Because the vulnerable code is firmware in the modem/baseband, exploitation does not require a malicious app, a rooted device, or any on-device code execution.

What is not available: the specific protocol layer (e.g., NAS, RRC, or an IP-layer path), the exact malformed message structure, the parser or handler affected, and the list of chipset families or firmware builds. These details are not present in the NVD description and must not be assumed. The precise trigger — which malformed field, length, or state causes the assertion — has not been publicly disclosed.

The fact that the CNA lists two patch IDs (MOLY01870473 and MOLY00814393) suggests either two affected firmware branches or a multi-part fix, but the data provided does not confirm the mapping.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-20525 as of this report. The attack chain below is inferred strictly from the vulnerability class and the stated precondition in the NVD description.

1. Reconnaissance/target identification: The attacker identifies target UEs within radio range. Because the flaw is triggered only after a UE connects to a rogue base station, the attacker must be positioned to broadcast as a legitimate cell (or a more attractive cell) so that nearby UEs select it. This is a physical-proximity attack; the "blast radius" is limited to the attacker's RF coverage area (a room, a floor, or a small outdoor perimeter depending on transmit power).

2. Trigger of the specific flaw class: Once the UE has camped on the rogue base station, the attacker drives the UE through normal attach/registration and subsequent signaling. During that exchange, the attacker sends malformed input fields. Because the underlying defect is improper input validation (CWE-617), a value that violates an internal invariant causes a reachable assertion in the modem stack. The description does not identify the message type, parameter, or field, so the exact malformed input cannot be stated here.

3. Payload/execution method (vulnerability-class level): No memory-corruption payload is required and none is described. The "payload" is the malformed signaling input itself. Delivery is over the air interface between the rogue base station and the UE. No code is executed on the device; the attacker simply supplies input the modem parser fails to reject. This makes the attack conceptually simple to retry — if one malformed variant does not trigger the assertion, the attacker can iterate.

4. Post-exploitation impact: The stated outcome is a modem crash / remote denial of service. In practice, a baseband abort typically forces the modem to reset and re-register, which interrupts voice, SMS, and mobile data for the duration of the reset and any subsequent crash loop. If the attacker persists in transmitting the triggering input, the UE can be held in a repeated crash/reconnect cycle, sustaining the DoS. The description notes only "system crash" and does not claim memory corruption, code execution, or data exfiltration, so those impacts are out of scope based on the data available.

Impact Assessment

• Business impact: Loss of cellular connectivity (voice, SMS, mobile data) for affected UEs while in range of the attacker's rogue base station. For enterprise fleets — field devices, IoT/M2M endpoints, mobile hotspots, and employee handsets using affected modems — this can mean dropped calls, failed transactions, lost telemetry, and repeated reconnection churn.
• Affected systems: Any device whose modem/firmware contains the vulnerable code. The vendor/product and affected version ranges are not specified in the data provided; MediaTek modem firmware is widely used across device OEMs, so the theoretical population is broad, but no confirmed affected-device list is available here.
• CVSS subscores: NVD has not published a CVSS score or vector (N/A). No subscores are available to reference. Based on the description alone, the qualitative profile is: adjacent-network attack vector, low attack complexity from the attacker's perspective once a rogue base station is in place, no privileges required, no user interaction, availability-only impact. EPSS has not been scored by FIRST.org, and CISA KEV does not list this CVE.
• Blast radius: Physically bounded by RF coverage of the attacker's transmitter. This is not a wormable or internet-scale issue.

Detection Guidance

Detection for a baseband assertion crash is inherently difficult on the endpoint because modem firmware events are often opaque to the host OS. The rules below target the observable side effects (firmware crash/assertion strings, modem reset events, rogue-cell signaling patterns) and should be tuned to the fleet. No public PoC exists, so these are behavioral/telemetry detections rather than signature matches for known exploit traffic.

Sigma Rule

title: Potential Modem/Baseband Assertion Crash (CVE-2026-20525)
id: 8f2c1a44-9b7e-4d21-a1c3-20525cve0001
status: experimental
description: Detects kernel/modem logs indicating a baseband assertion or modem subsystem crash possibly triggered by a rogue base station (CVE-2026-20525, CWE-617).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20525
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  selection_assert:
    - "modem*assert*"
    - "baseband*assert*"
    - "MSV-9041"
  selection_crash:
    - "modem crash"
    - "modem subsystem restart"
    - "cp crash"
    - "subsys*restart*modem*"
  condition: selection_assert or selection_crash
falsepositives:
  - Benign modem firmware recovery events
  - Lab testing with test SIMs / test networks
level: medium

YARA Rule

rule CVE_2026_20525_Modem_Assertion_Indicators
{
    meta:
        description = "Scans firmware/log artifacts for strings associated with CVE-2026-20525 modem assertion crash handling"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20525"
        date = "2026-01-01"
    strings:
        $patch1 = "MOLY01870473" ascii wide
        $patch2 = "MOLY00814393" ascii wide
        $issue  = "MSV-9041" ascii wide
        $s1 = "modem_assert" ascii
        $s2 = "baseband assert" ascii nocase
    condition:
        uint16(0) == 0x5A4D or 2 of ($patch1,$patch2,$issue,$s1,$s2)
}

Suricata IDS Rule

Network visibility into the radio access path is limited, but where modem control/signaling traffic is captured (e.g., test benches, virtualized core, or debug interfaces), the following rule flags conspicuous modem-restart storm behavior. It is a heuristic, not a signature for the unknown trigger input.

alert udp any any -> any any (msg:"CVE-2026-20525 Possible Modem Assertion / Rapid UE Re-registration Storm"; \
  flow:to_server; \
  detection_filter: track by_src, count 30, seconds 60; \
  threshold: type threshold, track by_src, count 30, seconds 60; \
  classtype:attempted-dos; \
  sid:1000525; rev:1; \
  metadata:cve CVE-2026-20525;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ any where process.name != null and
      wildcard(message, "*modem*assert*") ]
  [ any where
      wildcard(message, "*modem subsystem restart*") or
      wildcard(message, "*cp crash*") or
      wildcard(message, "*MSV-9041*") ]

Splunk SPL Query

index=endpoint_logs (source=modem OR source=kernel OR source=logcat)
("modem" AND ("assert" OR "crash" OR "subsystem restart" OR "MSV-9041"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, source
| where count > 2
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="cve-2026-20525,modem,dos,">
  <rule id="100525" level="8">
    <decoded_as>syslog</decoded_as>
    <match>modem_assert|baseband assert|modem subsystem restart|cp crash|MSV-9041</match>
    <description>CVE-2026-20525: Possible modem/baseband assertion crash (rogue base station DoS)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Track and apply the vendor fix once the device OEM ships it. The referenced MediaTek patch IDs are MOLY01870473 / MOLY00814393 (issue MSV-9041); downstream OEMs must integrate these baseband builds. Do not assume a device is fixed until the OEM confirms.
• Reduce exposure for high-value or mission-critical UEs: minimize field time in untrusted RF environments where a rogue base station could be deployed.
• Where fleets use private cellular or managed networks, enforce cell selection/roaming policies that limit attachment to authorized cells only.
• Monitor modem reset/crash telemetry on managed devices so rogue-cell DoS campaigns can be identified and localized.

2. Patch/upgrade steps

• Contact each device OEM and chipset vendor with the MediaTek issue ID MSV-9041 and patch IDs MOLY01870473 / MOLY00814393 to determine which firmware builds include the fix.
• Validate the installed baseband version after updating (modem firmware version, not just the OS build).
• Note: no CVE-specific vendor advisory, fixed version numbers, or distribution packages are present in the data available; affected version ranges could not be enumerated.

3. Long-term hardening

• Include baseband firmware version inventory in asset management so future modem CVEs can be triaged fleet-wide.
• Establish an RF threat-monitoring capability (rogue base station / IMSI-catcher detection) for environments that carry sensitive traffic.
• Require baseband patching commitments in procurement and support contracts for long-lifecycle devices (IoT, M2M, embedded modems).

References

• NVD — CVE-2026-20525: https://nvd.nist.gov/vuln/detail/CVE-2026-20525
• CWE-617 (Reachable Assertion): https://cwe.mitre.org/data/definitions/617.html
• MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FIRST EPSS: no score published for CVE-2026-20525 at time of writing (https://www.first.org/epss/)
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-20525 not listed (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

Threat actor campaigns / exploit-in-the-wild: None observed. No public PoC, exploit code, or Nuclei template is available, and there is no CISA KEV listing. The CNA references only patch IDs (MOLY01870473 / MOLY00814393) and issue ID MSV-9041; no vendor advisory URL was supplied in the provided data.