CVE-2026-21549 Overview
CVE-2026-21549 is an improper input validation vulnerability [CWE-20] in the Unisoc modem component. A remote attacker can send crafted input to the modem stack to trigger a denial of service. Exploitation requires no user interaction and no authentication. The flaw affects only availability, with no impact on confidentiality or integrity. Unisoc disclosed the issue in its product security bulletin.
Critical Impact
Remote unauthenticated attackers can cause a denial of service against affected Unisoc modem devices without additional execution privileges.
Affected Products
- Unisoc modem component (see the Unisoc Security Bulletin for the affected chipsets and firmware baselines)
Discovery Timeline
- 2026-08-03 - CVE-2026-21549 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-21549
Vulnerability Analysis
The vulnerability resides in the Unisoc modem firmware. The modem accepts network-supplied input without adequately validating its structure or bounds. When a malformed message reaches the vulnerable code path, the modem enters an unrecoverable state and stops servicing legitimate traffic. The bulletin classifies the outcome as a remote denial of service with no privilege escalation and no code execution required. Because cellular baseband processors handle unauthenticated over-the-air messages, this class of flaw is reachable without prior access to the device.
Root Cause
The root cause is improper input validation [CWE-20] in a modem message-handling routine. The component does not enforce the expected constraints on attacker-controlled fields before acting on them, allowing crafted input to disrupt modem operation.
Attack Vector
The attack vector is network based. An adversary within radio range, or one who can inject traffic into a signaling path reachable by the modem, can transmit a malformed protocol message. The modem parses the message and reaches the vulnerable branch, resulting in a service disruption for the affected device.
No verified public exploit or proof-of-concept has been published. See the Unisoc Security Bulletin for vendor technical details.
Detection Methods for CVE-2026-21549
Indicators of Compromise
- Unexpected loss of cellular connectivity across multiple devices in the same coverage area with no corresponding carrier outage.
- Repeated modem resets, radio subsystem crashes, or baseband watchdog events in device diagnostic logs.
- Anomalous signaling traffic observed by cellular monitoring platforms targeting devices running vulnerable Unisoc firmware.
Detection Strategies
- Correlate device telemetry for modem restart events and radio interface failures against known-good baselines.
- Track vendor bulletin identifiers and firmware build strings across the mobile fleet to identify unpatched devices exposed to CVE-2026-21549.
- Where available, ingest carrier and MDM logs into a central analytics platform to identify clusters of connectivity loss consistent with a targeted denial-of-service attempt.
Monitoring Recommendations
- Monitor mobile device management (MDM) health signals for repeated cellular disconnects on Unisoc-based hardware.
- Alert on firmware versions that remain below the fixed baseline listed in the Unisoc security bulletin.
- Review device crash reports for modem or baseband process failures following exposure to untrusted radio environments.
How to Mitigate CVE-2026-21549
Immediate Actions Required
- Inventory devices that use Unisoc modem chipsets and identify those running firmware predating the vendor fix.
- Apply the modem firmware update referenced in the Unisoc security bulletin as soon as it is delivered by the device OEM or carrier.
- Prioritize patching for devices operating in untrusted radio environments or high-availability roles.
Patch Information
Unisoc has published a fix through its product security bulletin. Consult the Unisoc Security Bulletin for the specific patched firmware versions and coordinate deployment with the device manufacturer or mobile carrier responsible for firmware distribution.
Workarounds
- No vendor-supplied workaround is documented; firmware update is the supported remediation path.
- For high-risk deployments, restrict affected devices to trusted networks or Wi-Fi only until patched firmware is available.
- Enforce MDM policies that alert on and quarantine devices running vulnerable firmware baselines.
# Example: query connected Android devices for build and modem firmware
adb shell getprop ro.build.fingerprint
adb shell getprop gsm.version.baseband
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
