In Modem

This is a MediaTek baseband bug (Patch ID MOLY01816800, Issue MSV-6842) in the modem's handling of malformed over-the-air signaling. A UE that camps on an attacker-controlled base station and receives a crafted message crashes the modem — the phone drops the cellular link until it reboots or re-attaches. Affected products span MediaTek's mobile chipset families shipped in Android handsets and IoT/CPE modems; MediaTek's July 2026 security bulletin is the canonical list. CWE is classified as 288 (auth bypass via alternate path) in NVD, but the practical primitive is improper input validation leading to DoS, not code execution or persistent auth compromise.

There is no vendor CVSS baseline for this CVE, so noisgate is establishing the first assessment. The impact ceiling is denial of service on a single handset within RF range of a rogue eNB/gNB — no RCE, no privilege escalation, no data disclosure documented, no lateral movement, no persistence past re-attach. Real-world severity is LOW: the exploit prerequisite (a rogue base station within physical proximity of a targeted device) is the same barrier that gates every Stingray-class attack, and the payoff is only a reboot.

Why this verdict

• No vendor baseline — establishing first assessment. Neither NVD nor MediaTek published a CVSS score; noisgate scores ~3.8 based on the documented primitive.
• Attack vector is Adjacent (RF), not Network. Exploitation requires a rogue base station within antenna range of the victim UE — this is Stingray-class tradecraft, not internet-reachable.
• Impact is availability-only, single device. No RCE, no privilege escalation, no data disclosure, no persistence past modem reset. Vendor description explicitly says *system crash* / *remote DoS*.
• Role multiplier: consumer handset (typical role). Chain succeeds → one phone loses signal until reboot. Blast radius: local, single-device. No fleet impact.
• Role multiplier: IoT/CPE/M2M modem in a fleet (high-value role). Chain succeeds → attacker with an RF footprint over a warehouse or industrial site could brown-out cellular-connected sensors within that footprint. Blast radius still bounded to RF coverage; no lateral movement, no data compromise. Does not cross the HIGH floor — no domain, identity, hypervisor, or supply-chain surface is touched.
• No KEV, no PoC, no EPSS traction. Zero indicators of imminent operational risk.

Why not higher?

MEDIUM/HIGH would require either an internet-reachable vector, code execution, or persistent impact — none are present. The rogue-base-station prerequisite alone caps this well below MEDIUM for any threat model that isn't a targeted-surveillance operation against a specific individual.

Why not lower?

IGNORE would require the bug to be non-exploitable in practice or the affected footprint to be negligible. MediaTek chipsets ship in hundreds of millions of Android handsets and IoT devices, and journalists, executives, and dissidents genuinely are targeted by IMSI-catchers — a documented DoS primitive is a real (if narrow) tool in that playbook.

1. Apply July 2026 SPL to managed Android fleet on normal cadence — The MediaTek fix rides the Android Security Bulletin (SPL 2026-07-05). LOW verdict carries no noisgate mitigation SLA — go straight to the 365-day remediation window and let normal MDM patch rings handle it.
2. Disable 2G/3G fallback on high-risk-user handsets — For executives, journalists, or personnel travelling to high-surveillance regions, enforce 5G-SA-preferred and 2G-off via MDM (Android Enterprise setCellularTwoGDisabled, iOS Lockdown-equivalents). Removes the easiest downgrade path an IMSI-catcher uses to force camp. Deploy alongside the next MDM policy push.
3. Enroll high-risk users in Android Advanced Protection or equivalent — Surfaces rogue-cell / null-cipher warnings and blocks unencrypted cellular where available. Deploy for VIP cohort now — no reason to wait on this regardless of CVE.
4. Inventory MediaTek chipsets in IoT/CPE/M2M fleet — Router, POS, and industrial-IoT deployments often use MediaTek basebands and lag Android SPL. Confirm carrier/OEM patch availability so these devices are not stranded when the vendor patch ships.

Run this on an auditor workstation with Android Debug Bridge (adb) in PATH and a target Android device connected via USB with USB debugging enabled. Invoke as .\Check-CVE-2026-20459.ps1 -SerialNumber <adb-device-id>. No elevated privileges required; the script reads ro.build.version.security_patch and the modem baseband version.

#!/usr/bin/env pwsh
# Check-CVE-2026-20459.ps1
# Detects whether an attached Android device carries the July 2026 SPL that
# includes MediaTek Patch ID MOLY01816800 (CVE-2026-20459).
#
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

param(
    [Parameter(Mandatory=$true)]
    [string]$SerialNumber
)

$ErrorActionPreference = 'Stop'

function Invoke-Adb {
    param([string]$Cmd)
    return (& adb -s $SerialNumber shell $Cmd 2>$null).Trim()
}

try {
    $spl      = Invoke-Adb 'getprop ro.build.version.security_patch'
    $baseband = Invoke-Adb 'getprop gsm.version.baseband'
    $chipset  = Invoke-Adb 'getprop ro.hardware'
    $vendor   = Invoke-Adb 'getprop ro.vendor.mediatek.platform'
} catch {
    Write-Output 'UNKNOWN: adb query failed'
    exit 2
}

Write-Output "Device      : $SerialNumber"
Write-Output "Chipset     : $chipset"
Write-Output "MTK platform: $vendor"
Write-Output "Baseband    : $baseband"
Write-Output "SPL         : $spl"

# Only MediaTek-based devices are in scope
$isMtk = ($chipset -match 'mt[0-9]{4}') -or ($vendor -ne '')
if (-not $isMtk) {
    Write-Output 'PATCHED (not MediaTek — CVE-2026-20459 not applicable)'
    exit 0
}

# Fix rides Android Security Bulletin 2026-07-05
try {
    $splDate = [datetime]::ParseExact($spl, 'yyyy-MM-dd', $null)
} catch {
    Write-Output 'UNKNOWN: could not parse SPL'
    exit 2
}

$fixed = [datetime]'2026-07-05'
if ($splDate -ge $fixed) {
    Write-Output 'PATCHED'
    exit 0
} else {
    Write-Output 'VULNERABLE — SPL predates 2026-07-05; MOLY01816800 not present'
    exit 1
}

Sources

1. OffSeq Threat Radar — CVE-2026-20459
2. MediaTek Product Security Bulletin (July 2026)
3. Android Security Bulletin — July 2026
4. NVD — CVE-2026-20459
5. MITRE CVE Record — CVE-2026-20459
6. CWE-288 — Authentication Bypass Using an Alternate Path or Channel
7. srsRAN Project (rogue-cell tooling context)
8. BaseSpec / FirmWire baseband fuzzing research