CVE-2026-21551: Modem DOS Vulnerability

CVE-2026-21551 Overview

CVE-2026-21551 is an improper input validation vulnerability [CWE-20] in the Unisoc modem component. A remote attacker can send malformed input to the affected modem to trigger a denial of service condition on the target device. Exploitation requires no user interaction, no authentication, and no additional execution privileges.

The issue is tracked in the Unisoc Security Bulletin and is exploitable over the network attack surface exposed by the modem.

Critical Impact
Remote, unauthenticated attackers can trigger a denial of service against affected Unisoc modem-equipped devices without user interaction.

Affected Products

Devices incorporating Unisoc modem chipsets identified in the vendor bulletin
Mobile handsets and IoT devices using affected baseband firmware
Refer to the Unisoc Security Bulletin for the definitive component and version list

Discovery Timeline

2026-08-03 - CVE-2026-21551 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-21551

Vulnerability Analysis

The vulnerability resides in the input handling logic of the Unisoc modem firmware. The modem fails to properly validate structure or content of incoming data before processing it. Malformed input reaches parsing or state-machine routines that assume well-formed values, triggering an abnormal termination or hang in the modem stack.

The resulting denial of service disrupts cellular connectivity for the affected device. Because the modem processes attacker-controlled traffic before higher-level operating system protections apply, exploitation does not require any application-layer access on the target.

The EPSS score is 0.403% (33.163 percentile), indicating limited observed exploitation activity at publication.

Root Cause

The root cause is improper input validation [CWE-20] in the modem firmware. Data structures received over the radio interface are consumed without sufficient bounds, type, or state checks. When an attacker supplies values outside expected ranges, the modem enters an error path that produces a crash or resource exhaustion rather than safely rejecting the input.

Attack Vector

The attack vector is network-based and requires low complexity. An attacker within radio range or on a reachable network path can transmit crafted messages to the modem to disrupt service. No user interaction and no credentials are required. Confidentiality and integrity are not affected; availability is the sole impact.

No verified public proof-of-concept exists for this issue. Refer to the Unisoc Security Bulletin for technical specifics disclosed by the vendor.

Detection Methods for CVE-2026-21551

Indicators of Compromise

Unexpected modem restarts, radio disconnects, or loss of cellular registration on affected devices
Kernel or ril (radio interface layer) logs showing modem crash dumps or SUBSYSTEM_RESTART events
Repeated baseband reset events correlated with proximity to unknown transmitters or attacker-controlled network paths

Detection Strategies

Monitor device telemetry for abnormal frequency of modem subsystem restarts across a fleet
Correlate cellular disconnection events with logs from mobile device management (MDM) platforms to identify affected models
Compare baseband firmware versions against the fixed versions listed in the Unisoc bulletin

Monitoring Recommendations

Ingest MDM and endpoint telemetry into a centralized data lake to identify patterns of modem instability
Alert on clusters of Unisoc-equipped devices experiencing simultaneous loss of connectivity
Track vendor security bulletins to confirm firmware patch coverage across managed devices

How to Mitigate CVE-2026-21551

Immediate Actions Required

Inventory all devices using Unisoc modem chipsets referenced in the vendor bulletin
Apply the baseband firmware update supplied by Unisoc or the device OEM as soon as available
Prioritize patching for devices operating in untrusted radio environments or exposed field deployments

Patch Information

Unisoc has published fix information in the Unisoc Security Bulletin. Device OEMs must integrate the patched baseband firmware into their over-the-air (OTA) update packages. End users receive the fix through OEM-issued firmware updates.

Workarounds

No vendor-supplied workaround is documented; firmware update is the authoritative remediation
Where patching is delayed, restrict device operation to trusted radio environments to reduce exposure
Enforce OTA update policies through MDM to accelerate rollout of the fixed baseband

bash

# Verify baseband firmware version on an Android device
adb shell getprop gsm.version.baseband
# Compare returned version against the fixed build listed in the Unisoc bulletin