MediaTek modem remote DoS via malformed signaling from rogue base station

#!/usr/bin/env pwsh
# Check-CVE-2026-20459.ps1
# Detects whether an attached Android device carries the July 2026 SPL that
# includes MediaTek Patch ID MOLY01816800 (CVE-2026-20459).
#
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

param(
    [Parameter(Mandatory=$true)]
    [string]$SerialNumber
)

$ErrorActionPreference = 'Stop'

function Invoke-Adb {
    param([string]$Cmd)
    return (& adb -s $SerialNumber shell $Cmd 2>$null).Trim()
}

try {
    $spl      = Invoke-Adb 'getprop ro.build.version.security_patch'
    $baseband = Invoke-Adb 'getprop gsm.version.baseband'
    $chipset  = Invoke-Adb 'getprop ro.hardware'
    $vendor   = Invoke-Adb 'getprop ro.vendor.mediatek.platform'
} catch {
    Write-Output 'UNKNOWN: adb query failed'
    exit 2
}

Write-Output "Device      : $SerialNumber"
Write-Output "Chipset     : $chipset"
Write-Output "MTK platform: $vendor"
Write-Output "Baseband    : $baseband"
Write-Output "SPL         : $spl"

# Only MediaTek-based devices are in scope
$isMtk = ($chipset -match 'mt[0-9]{4}') -or ($vendor -ne '')
if (-not $isMtk) {
    Write-Output 'PATCHED (not MediaTek — CVE-2026-20459 not applicable)'
    exit 0
}

# Fix rides Android Security Bulletin 2026-07-05
try {
    $splDate = [datetime]::ParseExact($spl, 'yyyy-MM-dd', $null)
} catch {
    Write-Output 'UNKNOWN: could not parse SPL'
    exit 2
}

$fixed = [datetime]'2026-07-05'
if ($splDate -ge $fixed) {
    Write-Output 'PATCHED'
    exit 0
} else {
    Write-Output 'VULNERABLE — SPL predates 2026-07-05; MOLY01816800 not present'
    exit 1
}