CVE-2026-20406: Mediatek Nr15 DoS Vulnerability

CVE-2026-20406 Overview

CVE-2026-20406 is a denial of service vulnerability affecting the modem component in a wide range of MediaTek chipsets. The vulnerability stems from an uncaught exception condition that can cause a system crash when a User Equipment (UE) connects to a rogue base station controlled by an attacker. This vulnerability is particularly concerning because it requires no user interaction and no additional execution privileges to exploit, making it an attractive target for attackers seeking to disrupt mobile device connectivity.

Critical Impact

Remote attackers can crash affected devices by setting up malicious base stations, causing complete loss of cellular connectivity without any user interaction required.

Affected Products

• MediaTek NR15, NR16, NR17, NR17R (5G NR modem firmware)
• MediaTek MT67xx series chipsets (MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6983, MT6985, MT6986, MT6989, MT6990, MT6991, MT6993)
• MediaTek MT27xx series chipsets (MT2735, MT2737)
• MediaTek MT87xx series chipsets (MT8668, MT8673, MT8675, MT8676, MT8678, MT8755, MT8771, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893)

Discovery Timeline

• February 2, 2026 - CVE-2026-20406 published to NVD
• February 4, 2026 - Last updated in NVD database

Technical Details for CVE-2026-20406

Vulnerability Analysis

This vulnerability resides in the modem firmware component of MediaTek chipsets, specifically in code paths that handle cellular network signaling. The issue is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that the modem firmware fails to properly handle exceptional conditions during cellular communication.

The attack requires the target device to connect to a rogue base station controlled by the attacker. Once connected, the attacker can send specially crafted signaling messages that trigger an uncaught exception in the modem processor, resulting in a system crash. The broad scope of affected chipsets, spanning multiple generations of MediaTek mobile and tablet SoCs, significantly increases the potential attack surface across millions of devices worldwide.

Root Cause

The root cause is improper exception handling within the MediaTek modem firmware. When the modem receives malformed or unexpected signaling data from a base station, certain code paths fail to catch and handle the resulting exception. This unhandled exception propagates through the modem subsystem, ultimately causing a system crash. The specific issue is tracked internally by MediaTek as Patch ID MOLY01726634 and Issue ID MSV-5728.

Attack Vector

The attack vector is network-based, requiring the attacker to operate a rogue cellular base station (often called a "stingray" or IMSI catcher). The attack flow proceeds as follows:

1. The attacker deploys a rogue base station that broadcasts stronger signals than legitimate towers or exploits cell selection algorithms
2. The victim's device automatically connects to the malicious base station following standard cellular protocols
3. The rogue base station sends specially crafted signaling messages to the connected device
4. The malformed data triggers an uncaught exception in the modem firmware
5. The exception causes the device to crash or experience complete loss of cellular connectivity

This attack is particularly dangerous in scenarios where devices rely on cellular connectivity for critical operations, such as emergency communications or IoT deployments.

Detection Methods for CVE-2026-20406

Indicators of Compromise

• Unexpected device reboots or crashes occurring in areas with unusual cellular network conditions
• Modem subsystem crash logs indicating unhandled exceptions in the baseband processor
• Multiple devices in the same geographic area experiencing simultaneous connectivity issues
• Abnormal cellular tower connections that don't match known carrier infrastructure

Detection Strategies

• Monitor device telemetry for unusual patterns of modem crashes or restarts across device fleets
• Implement cellular network monitoring solutions that can detect unauthorized base stations in sensitive areas
• Deploy endpoint detection solutions capable of correlating device crashes with cellular connectivity events
• Review system logs for modem-related crash dumps with exception indicators

Monitoring Recommendations

• Enable crash reporting and analytics for modem subsystem events on managed device fleets
• Implement network security solutions that can identify rogue base station characteristics
• Monitor for unusual cellular cell reselection patterns that may indicate base station spoofing attempts
• Establish baselines for normal modem behavior to detect anomalous crash patterns

How to Mitigate CVE-2026-20406

Immediate Actions Required

• Apply the latest firmware updates from device OEMs that incorporate MediaTek's security patch MOLY01726634
• Prioritize patching for devices deployed in high-risk environments or those used for critical communications
• Review device fleet management consoles for devices running vulnerable MediaTek chipsets
• Consider temporary use of Wi-Fi connectivity in high-security environments until patches are applied

Patch Information

MediaTek has released a security patch addressing this vulnerability, documented in the MediaTek Security Bulletin February 2026. The fix is tracked under Patch ID MOLY01726634. Device manufacturers (OEMs) must integrate this patch into their firmware updates and distribute them to end users. Users should check with their device manufacturer for available updates.

Workarounds

• In critical security environments, consider using Faraday bags or cellular signal blocking when devices are not actively needed
• Where possible, configure devices to prefer Wi-Fi connectivity over cellular networks
• For enterprise deployments, implement mobile device management (MDM) policies that can monitor for and respond to unusual modem behavior
• Avoid using affected devices for critical communications in areas where rogue base station attacks are suspected

# Check device for MediaTek chipset (Android)
# This command helps identify if a device uses an affected MediaTek SoC
adb shell getprop ro.hardware
adb shell cat /proc/cpuinfo | grep Hardware

# Monitor for modem crash events in Android logs
adb logcat | grep -i "modem\|baseband\|ril"