In Modem

CVE-2026-20460 is an improper input validation flaw (CWE-288 authentication bypass by alternate channel) sitting inside the MediaTek modem firmware — the baseband processor that speaks LTE/5G on the RF side of the device. When a device attaches to a rogue base station (an SDR-driven IMSI-catcher running something like srsRAN, YateBTS, or OpenLTE), a malformed control-plane message causes the modem to leak memory contents back over the air. No user interaction, no authentication, no privileges on the handset are required. The affected chipset list is enormous: MT2735, MT6779/6789/6833/6853/6873/6877/6885/6893/6895/6897, MT6980/6983/6985/6989/6991, MT8781/8788/8791/8796/8798 and dozens more — effectively every mid-to-flagship MediaTek modem sold in the last ~6 years, patched via MOLY01811421 / MSV-6788 in MediaTek's July 2026 bulletin.

MediaTek labels this HIGH and provides no CVSS. That label is fair, arguably generous. The impact is *information disclosure* — not RCE, not persistence — and exploitation requires the attacker to stand up a rogue eNodeB/gNodeB within RF range of the victim. That is a real capability (nation-states, targeted surveillance, and stingray-equipped criminal crews all have it) but it is not click-a-link scale. Treat this as a mobile-fleet risk with a narrow but capable adversary class, not as a wormable panic.

Why this verdict

• Attack vector is adjacent-radio, not internet-remote: attacker needs SDR hardware and physical proximity. This narrows the plausible adversary set to nation-state, targeted surveillance, and stingray-equipped organized crime — not opportunistic ransomware crews.
• Impact is info disclosure, not code execution: no persistence, no lateral movement, no privilege escalation on the AP. Leaked material is bounded to baseband memory adjacent to the parse buffer.
• Role multiplier — smartphone endpoint: for standard BYOD/COPE fleets the blast radius is single-device identifier leakage (IMSI, TMSI, session key fragments). Not fleet-scale. Not domain-scale.
• Role multiplier — executive / high-value target device: for a CEO, board member, M&A team, or intelligence-sensitive user, leakage of persistent subscriber identifiers enables long-term tracking and downstream SS7/Diameter attacks. Chain outcome = surveillance-grade compromise of that user. This is what floors the verdict at HIGH.
• Role multiplier — IoT / telematics / cellular routers (MTK-based): many industrial cellular gateways, fleet telematics units, and cellular CPE use MediaTek modems. Leak of session material from a rogue-BTS attack in a parking lot near a logistics depot is plausible; still bounded to info-disclosure.
• No public PoC, no KEV, EPSS effectively floor: exploitation is real but not commoditized. This prevents an upgrade to CRITICAL absent active-exploitation evidence.
• Undetectable on-device: neither MDM, MTD (Lookout, Zimperium), nor EDR sees baseband-level shenanigans. That opacity is a partial upgrade pressure — you cannot detect what you cannot see.

Why not higher?

Not CRITICAL because the outcome is bounded information disclosure — no RCE on the application processor, no code execution, no fleet-scale pivot. Exploitation requires physical proximity plus a rogue base station, which caps the practical attacker population at capable and motivated adversaries. No KEV listing and no observed in-the-wild campaigns as of disclosure.

Why not lower?

Not MEDIUM because the affected component (cellular baseband) sits in an unmonitored trust zone below the OS, requires zero user interaction, and the affected chipset list covers a huge share of Android devices globally. Leaking IMSI/session material to a targeted-surveillance adversary is a serious, non-recoverable exposure for high-value users. Endpoint defenders have no compensating visibility.

1. Push OEM security patch level ≥ 2026-07-05 to all MediaTek-based fleet devices — This is the only real fix. Coordinate with MDM (Intune, Jamf, Workspace ONE, Kandji) to enforce minimum patch level compliance policy. Given a HIGH verdict, deploy within the noisgate mitigation window of 30 days and reach full remediation within 180 days as OEM rollouts land.
2. Enforce 5G-SA-preferred and disable 2G on managed devices — Android 12+ exposes a 2G-disable toggle; enforce via MDM policy. 5G-SA with SUCI encrypted identifiers reduces the class of leakable data and makes rogue-BTS attach substantially harder. Deploy within 30 days alongside patch rollout.
3. Issue executive / high-risk-user travel guidance — For M&A, legal, exec, and intel-sensitive roles: airplane-mode + Wi-Fi (with VPN) while in high-threat locales (conferences, foreign travel, protest zones). Baseband cannot be attacked if the radio is off. Roll into existing high-risk-traveler program within 30 days.
4. Inventory MediaTek exposure in BYOD, IoT, and cellular CPE — Pull chipset data from MDM (Android Build.HARDWARE, ro.board.platform) and from cellular router / telematics vendor lists. You cannot patch what you have not counted. Complete inventory in the first 7 days of the mitigation window.
5. Deploy IMSI-catcher detection for high-value users — Apps like SnoopSnitch (rooted Android) or enterprise tools (ESD Overwatch, Cellebrite Rogue Detect) at least surface anomalous cell environments around VIPs. Not scalable to fleet, but appropriate for the top 1% of risk.

Run this on a managed Android device via ADB (auditor workstation with USB-debug enabled target, adb shell bash /sdcard/check-cve-2026-20460.sh) or push via MDM as a compliance script. Requires shell / ADB access; no root needed. Compares device chipset and Android security patch level against the July 2026 MediaTek bulletin fix.

#!/system/bin/sh
# CVE-2026-20460 — MediaTek modem info-disclosure check
# Verifies: (1) device uses affected MediaTek chipset (2) Android SPL >= 2026-07-05
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN, 3 NOT_APPLICABLE

set -u

HW=$(getprop ro.hardware 2>/dev/null)
BOARD=$(getprop ro.board.platform 2>/dev/null)
SOC_MODEL=$(getprop ro.soc.model 2>/dev/null)
SOC_MFR=$(getprop ro.soc.manufacturer 2>/dev/null)
SPL=$(getprop ro.build.version.security_patch 2>/dev/null)

AFFECTED_REGEX='MT(2735|2737|6779|6781|6783|6785|6789|6813|6833|6835|6853|6855|6858|6873|6875|6877|6878|6879|6880|6883|6885|6886|6889|6890|6891|6893|6895|6896|6897|6899|6980|6983|6985|6986D|6988|6989|6990|6991|6993|8673|8675|8676|8678|8755|8765|8766|8766R|8768|8771|8775|8781|8786|8788|8788E|8789|8791|8791T|8792|8793|8795T|8796|8797|8798|8863|8873|8883|8893)'

IS_MTK=0
for v in "$HW" "$BOARD" "$SOC_MODEL" "$SOC_MFR"; do
  echo "$v" | grep -Eiq '(mediatek|mt[0-9]{4}|mtk)' && IS_MTK=1
done

if [ "$IS_MTK" -eq 0 ]; then
  echo "NOT_APPLICABLE — non-MediaTek device (hw=$HW board=$BOARD soc=$SOC_MODEL)"
  exit 3
fi

CHIP_HIT=0
for v in "$HW" "$BOARD" "$SOC_MODEL"; do
  echo "$v" | grep -Eiq "$AFFECTED_REGEX" && CHIP_HIT=1
done

if [ -z "$SPL" ]; then
  echo "UNKNOWN — could not read security_patch prop"
  exit 2
fi

# Compare SPL to 2026-07-05
SPL_NUM=$(echo "$SPL" | tr -d '-')
FIX_NUM=20260705

if [ "$SPL_NUM" -ge "$FIX_NUM" ] 2>/dev/null; then
  echo "PATCHED — chip=$SOC_MODEL SPL=$SPL (>= 2026-07-05)"
  exit 0
fi

if [ "$CHIP_HIT" -eq 1 ]; then
  echo "VULNERABLE — affected chipset ($SOC_MODEL / $BOARD) with SPL=$SPL (< 2026-07-05, needs MOLY01811421)"
  exit 1
fi

echo "UNKNOWN — MediaTek device but chipset ($SOC_MODEL / $BOARD) not in tracked list; verify against MediaTek PSB July 2026"
exit 2

Sources

1. MediaTek Product Security Bulletin — July 2026
2. OffSeq Threat Radar — CVE-2026-20460
3. MITRE CWE-288: Authentication Bypass Using an Alternate Path or Channel
4. CISA Known Exploited Vulnerabilities Catalog
5. srsRAN open-source 4G/5G software radio suite
6. SnoopSnitch — baseband anomaly / IMSI catcher detection
7. LTEFuzz research (KAIST) — LTE control-plane fuzzing
8. Android Enterprise 2G disable policy (Android 12+)