In Modem

CVE-2026-20457 is a NULL pointer dereference (CWE-476) in the MediaTek modem baseband stack. A malformed control-plane message from a rogue base station triggers an unchecked pointer path in the modem firmware, crashing the modem subsystem. Impact is confined to *availability* — the modem drops, the device loses cellular service until reset. Affected silicon is broad: MT2735/2737, MT6739, MT6761–6791, MT6793, MT6895/6896, MT6980/6983/6985, MT6989/6990, MT8666–8675, MT8765–8798, and MT8893 — essentially most current-gen MediaTek smartphone, tablet, and IoT chipsets. Patch identifier is MOLY01826924 (issue MSV-7301), landing in MediaTek's July 2026 Product Security Bulletin.

MediaTek scored this 5.3 / Medium (AV:A / AC:H / PR:N / UI:N / S:U / C:N / I:N / A:H). That mapping is defensible and we concur: adjacency required (attacker must be RF-proximate operating a fake gNB/eNB), no confidentiality or integrity impact, no code execution, no privilege gain. Vendor severity matches reality — this is a jammer with extra steps, not a baseband RCE.

Why this verdict

• No code execution, no memory corruption primitive. CWE-476 NULL deref in modem RTOS is a fault, not a control-flow hijack. Ceiling is a subsystem crash.
• Adjacent-network attack vector. Attacker must operate an RF transmitter within meters-to-hundreds-of-meters of the target on licensed spectrum — a felony in every regulated market and trivially triangulated.
• Self-recovery limits dwell. Android/iOS auto-restart the modem within seconds; attacker must continuously retransmit, which is indistinguishable from jamming and localizable.
• Role multiplier — consumer smartphone (typical role): chain succeeds → device loses cellular ~60s. Blast radius = single device, per-target. No lateral movement path.
• Role multiplier — enterprise MDM-managed executive handset (high-value role): chain succeeds → temporary voice/SMS/data loss on a VIP phone. This matters for MFA push and emergency comms but does NOT reach fleet compromise or identity takeover. Blast radius stays at one device.
• Role multiplier — IoT / automotive telematics module (MT2735/MT2737, MT8xxx): chain succeeds → cellular link drop on connected car, POS terminal, or industrial gateway. In safety-relevant automotive contexts this warrants attention, but crashing a single vehicle's modem within RF range is not a fleet-scale attack — floor stays MEDIUM.
• No exposure telemetry can improve on adjacency. Unlike an IP-facing bug, there is no Shodan/GreyNoise view of who is 'exposed' — exposure equals physical proximity to a hostile SDR, which is not a scalable attacker economy.

Why not higher?

HIGH requires either a plausible route to code execution (there isn't one — this is a NULL deref that faults), or fleet-scale blast radius (this is one device per rogue cell per session), or evidence of active exploitation (there is none). Vendor 5.3 lands squarely mid-MEDIUM and the friction/impact profile agrees.

Why not lower?

LOW would require negligible real-world impact. The bug is remotely triggerable with no auth and no user interaction over the air, affects an enormous chipset footprint including automotive telematics where cellular link loss has safety implications, and can be sustained via continuous rogue-cell transmission. That deserves a scheduled fix, not backlog hygiene.

1. Push OEM firmware updates as they land — The only real fix is the MediaTek MOLY01826924 patch delivered via OEM (Samsung, Xiaomi, Oppo, Vivo, Motorola, etc.) monthly security updates. Track OEM bulletins referencing MediaTek July 2026 PSB. Given MEDIUM verdict, apply within the noisgate remediation SLA of 365 days, but prioritize executive and automotive fleet handsets earlier.
2. Enforce 5G SA and disable 2G on managed devices — In your MDM (Intune, Jamf, Workspace ONE, MobileIron), disable 2G fallback and prefer 5G Standalone where carrier supports it. 5G SA enforces mutual authentication via SUCI/AKA, which raises the bar for rogue-base-station attach even before the vulnerable frame is delivered. Deploy on VIP and automotive-connected fleets.
3. Monitor for repeated cellular disconnect telemetry — In your EMM/MDM telemetry, alert on devices logging repeated modem crash / cellular loss events clustered by geolocation. Real DoS attempts will show as spatial-temporal clusters distinct from network outages. Useful for physical security in high-threat travel scenarios.
4. Advise VIP travelers to carry a backup channel — For executives and incident responders in high-threat regions, ensure a secondary comms path (satellite messenger, dual-SIM secondary carrier, Wi-Fi calling) so a modem DoS does not sever MFA push or emergency contact.

Run this on an Intune / Workspace ONE admin workstation with Microsoft Graph PowerShell installed and Intune read permissions. It enumerates managed Android devices, extracts chipset and security-patch-level, and flags MediaTek-based handsets that have not received a security patch dated 2026-07-01 or later. Invoke as: .\Check-CVE-2026-20457.ps1 -TenantId <your-tenant-guid>. Requires DeviceManagementManagedDevices.Read.All scope.

#!/usr/bin/env pwsh
# Check-CVE-2026-20457.ps1
# Flags MediaTek-based Android devices in Intune missing the July 2026 patch level.
# Output: VULNERABLE | PATCHED | UNKNOWN per device; exit 1 if any VULNERABLE found.

param(
    [Parameter(Mandatory=$true)][string]$TenantId
)

$ErrorActionPreference = 'Stop'
$PatchCutoff = Get-Date '2026-07-01'
$AnyVulnerable = $false

# Affected MediaTek chipset family prefixes (broad match against model/chipset string)
$MTKPrefixes = @('MT2735','MT2737','MT6739','MT6761','MT6762','MT6763','MT6765','MT6767','MT6768','MT6769','MT6771','MT6779','MT6781','MT6785','MT6789','MT6791','MT6793','MT6895','MT6896','MT6980','MT6983','MT6985','MT6989','MT6990','MT8666','MT8675','MT8765','MT8768','MT8781','MT8788','MT8791','MT8795','MT8798','MT8893')

try {
    Import-Module Microsoft.Graph.DeviceManagement -ErrorAction Stop
    Connect-MgGraph -TenantId $TenantId -Scopes 'DeviceManagementManagedDevices.Read.All' | Out-Null
} catch {
    Write-Error "Failed to connect to Microsoft Graph: $_"
    exit 2
}

$devices = Get-MgDeviceManagementManagedDevice -All -Filter "operatingSystem eq 'Android'"

foreach ($d in $devices) {
    $chip = "$($d.Manufacturer) $($d.Model) $($d.HardwareInformation.SystemManagementBIOSVersion)"
    $isMTK = $false
    foreach ($p in $MTKPrefixes) { if ($chip -match $p) { $isMTK = $true; break } }

    if (-not $isMTK) { continue }

    $spl = $d.AndroidSecurityPatchLevel
    if ([string]::IsNullOrWhiteSpace($spl)) {
        Write-Output "UNKNOWN`t$($d.DeviceName)`tno SPL reported"
        continue
    }

    try {
        $splDate = Get-Date $spl
        if ($splDate -ge $PatchCutoff) {
            Write-Output "PATCHED`t$($d.DeviceName)`tSPL=$spl"
        } else {
            Write-Output "VULNERABLE`t$($d.DeviceName)`tSPL=$spl chipset=$chip"
            $AnyVulnerable = $true
        }
    } catch {
        Write-Output "UNKNOWN`t$($d.DeviceName)`tunparseable SPL=$spl"
    }
}

if ($AnyVulnerable) { exit 1 } else { exit 0 }

Sources

1. MediaTek Product Security Bulletin — July 2026
2. OffSeq Threat Radar — CVE-2026-20457
3. CWE-476: NULL Pointer Dereference
4. srsRAN Project (rogue base station tooling context)
5. OpenAirInterface 5G Alliance
6. FirmWire baseband fuzzing (NDSS 2022) — class-of-bug context
7. 3GPP TS 33.501 — 5G security architecture (SUCI/AKA)
8. Singapore CSA — 08 April 2026 Security Bulletin (MediaTek advisories context)