This vulnerability (CVE-2026-20460) affects multiple MediaTek chipset models and involves an authentication bypass via an alternate path or channel (CWE-288). It results from improper input validation in the modem component, which can lead to remote information disclosure if a device connects to a malicious base station. No user interaction or elevated privileges are needed for exploitation. The CVSS v3.1 base score is 5.3, reflecting medium severity, with attack vector as adjacent network, high attack complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch information available to confirm remediation status.

An attacker controlling a rogue base station can remotely disclose sensitive information from a device using affected MediaTek chipsets without requiring user interaction or elevated privileges. The confidentiality impact is high, while integrity and availability are not affected. This could compromise user data privacy if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users and administrators should monitor MediaTek advisories for updates. Until a patch is available, avoid connecting to untrusted or suspicious base stations to reduce exposure.