CVE-2026-20401 is a vulnerability identified in multiple MediaTek modem chipsets (including MT2735, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT8675, MT8771, MT8791, MT8791T, MT8797) affecting the modem firmware version NR15. The issue arises from a reachable assertion failure (CWE-617) within the modem software, which leads to an uncaught exception causing the system to crash. This can be remotely triggered without any user interaction or privileges by an attacker who controls a rogue base station to which the user equipment (UE) connects. The vulnerability results in a denial of service (DoS) condition, disrupting modem functionality and potentially impacting device availability. The CVSS v3.1 score is 6.5 (medium severity), with attack vector being adjacent network (the attacker must be in radio proximity), low attack complexity, no privileges required, no user interaction, and impact limited to availability. No known exploits have been reported in the wild yet. The vendor has assigned a patch ID (MOLY01738310) and issue ID (MSV-5933), indicating a fix is available but no direct patch link is provided. This vulnerability is significant because it can be exploited remotely via the cellular network infrastructure, targeting mobile devices or embedded systems using these MediaTek chipsets, potentially causing service interruptions.

For European organizations, the primary impact of CVE-2026-20401 is the potential for remote denial of service on devices using the affected MediaTek modem chipsets. This could disrupt mobile communications for employees, IoT devices, or critical infrastructure relying on cellular connectivity. Telecom operators and enterprises deploying devices with these chipsets may face service degradation or outages if attackers deploy rogue base stations to exploit this vulnerability. Although confidentiality and integrity are not directly affected, availability issues can impact business operations, emergency communications, and critical services. The risk is heightened in sectors with high reliance on mobile connectivity such as transportation, healthcare, and public safety. Additionally, the presence of rogue base stations is a known tactic in targeted attacks and espionage, which could be leveraged in geopolitical contexts affecting European countries. The lack of required user interaction or privileges lowers the barrier for exploitation, increasing the threat surface for mobile endpoints and embedded devices.

To mitigate CVE-2026-20401, European organizations should: 1) Prioritize applying the vendor-provided patch (MOLY01738310) as soon as it becomes available to affected devices and modems. 2) Implement network monitoring to detect and block rogue base stations or suspicious cellular network behavior using IMSI catchers detection tools and radio frequency monitoring. 3) Employ endpoint security solutions capable of monitoring modem firmware integrity and alerting on abnormal modem crashes or resets. 4) Collaborate with mobile network operators to ensure network-level protections against rogue base stations and unauthorized access points. 5) For critical infrastructure, consider deploying redundant communication channels to maintain availability in case of targeted DoS attacks. 6) Educate users and administrators about the risks of connecting to untrusted cellular networks and encourage the use of VPNs or secure communication channels when possible. 7) Maintain an inventory of devices using affected MediaTek chipsets to assess exposure and prioritize remediation efforts.