{"id":"CVE-2026-20578","kind":"vulnerability","aliases":["CVE-2026-20578"],"related":[],"title":"Modem: side-channel flaw leaks data and enables remote denial of service","description":"In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879164; Issue ID: MSV-9846.","summary":"A side-channel weakness in the modem firmware can disclose information. The description says a phone or device that connects to a rogue base station controlled by an attacker could suffer a remote denial of service, with no extra privileges and no user interaction needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cellular","infrastructure","mobile-devices","modem"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T03:17:35+00:00","first_seen_at":"2026-11-02T03:31:25+00:00","triaged_at":"2026-11-02T03:32:16+00:00","updated_at":"2026-11-02T03:32:16+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-02T03:32:16Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Modem: side-channel flaw leaks data and enables remote denial of service","impact":"medium","summary":"A side-channel weakness in the modem firmware can disclose information. The description says a phone or device that connects to a rogue base station controlled by an attacker could suffer a remote denial of service, with no extra privileges and no user interaction needed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["modem","cellular","mobile-devices"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Information disclosed and remote denial of service on connected device","analyst_note":"Find the vendor bulletin for Patch ID MOLY01879164 / Issue ID MSV-9846 to confirm affected modem chipsets and fixed firmware versions.","how_to_check":"- unknown","plain_action":"Install the latest phone software update from your device maker once it is released, since the sources name a patch ID but no fixed version.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Devices with the affected modem firmware that can connect to a cellular network. The sources describe exposure when a device connects to a rogue base station, so the risk is tied to the cellular connection rather than to any installed application. The sources do not name the exact devices or modem versions affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":4119,"output_tokens":509,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-20578':16A,19A '-9846':127C 'addit':110C 'attack':55B,107C 'base':50B,102C 'cellular':20B 'channel':4A,29B,83C 'connect':46B,98C 'control':52B,104C 'could':56B,87C 'cve':14A,17A 'data':7A 'denial':11A,60B,91C 'descript':39B 'devic':24B,44B 'disclos':36B 'disclosur':79C,85C 'due':80C 'enabl':9A 'execut':111C 'exploit':120C 'extra':65B 'firmwar':34B 'flaw':5A 'id':122C,125C 'inform':37B,78C,84C 'infrastructur':21B 'interact':70B,115C 'issu':124C 'lead':88C 'leak':6A 'mobil':23B 'mobile-devic':22B 'modem':1A,25B,33B,73C 'moly01879164':123C 'msv':126C 'need':71B,113C,118C 'patch':121C 'phone':42B 'possibl':77C 'privileg':66B,112C 'remot':10A,59B,90C 'rogu':49B,101C 'say':40B 'servic':13A,62B,93C 'side':3A,28B,82C 'side-channel':2A,27B 'station':51B,103C 'suffer':57B 'ue':96C 'user':69B,114C 'weak':30B","nicknames":[],"mitigations":[],"who_affected":"Devices with the affected modem firmware that can connect to a cellular network. The sources describe exposure when a device connects to a rogue base station, so the risk is tied to the cellular connection rather than to any installed application. The sources do not name the exact devices or modem versions affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Install the latest phone software update from your device maker once it is released, since the sources name a patch ID but no fixed version.","pkeys":[],"ptokens":[],"labels":["cellular","infrastructure","mobiledevices","modem","unknown"],"first_public_at":"2026-11-02T03:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20578","severity":null,"published_at":"2026-11-02T03:17:35+00:00","modified_at":"2026-11-02T03:17:35+00:00","first_seen_at":"2026-11-02T03:31:25+00:00","fetched_at":"2026-11-02T03:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}