{"id":"CVE-2026-20599","kind":"vulnerability","aliases":["CVE-2026-20599"],"related":[],"title":"Modem firmware: missing permission check allows privilege escalation locally","description":"In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148.","summary":"A missing permission check in the modem component can let code that already runs with System privilege gain further privilege. The sources describe no remote path and no user interaction is needed once an attacker already holds System access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","modem"],"not_affected_if":["no-system-privilege-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T03:17:37+00:00","first_seen_at":"2026-11-02T03:31:26+00:00","triaged_at":"2026-11-02T03:32:02+00:00","updated_at":"2026-11-02T03:32:02+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T03:32:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Modem firmware: missing permission check allows privilege escalation locally","impact":"medium","summary":"A missing permission check in the modem component can let code that already runs with System privilege gain further privilege. The sources describe no remote path and no user interaction is needed once an attacker already holds System access.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["modem","android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker already holding System privilege gains further privilege on the device.","analyst_note":"Check the vendor bulletin for affected devices and the patch level that carries MSV-8148 and patch ID MOLY01790985.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-system-privilege-access"],"who_is_affected":"The flaw is in the modem component of a device, so it applies to the phone or device model covered by the vendor's bulletin. The sources do not name affected models or versions. An attacker must already hold System privilege on the device, so an ordinary app without that access is not the target.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000627,"input_tokens":4103,"output_tokens":434,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-20599':12A,15A '-8148':104C 'access':57B 'actor':84C 'allow':6A 'alreadi':31B,54B,86C 'android':16B 'attack':53B 'check':5A,22B,72C 'code':29B 'compon':26B 'could':74C 'cve':10A,13A 'describ':41B 'due':67C 'escal':8A,64C,78C 'exploit':97C 'firmwar':2A 'gain':36B 'hold':55B 'id':99C,102C 'infrastructur':17B 'interact':48B,92C 'issu':101C 'lead':75C 'let':28B 'local':9A,77C 'malici':83C 'miss':3A,20B,70C 'modem':1A,18B,25B,59C 'moly01790985':100C 'msv':103C 'need':50B,95C 'obtain':87C 'patch':98C 'path':44B 'permiss':4A,21B,71C 'possibl':63C 'privileg':7A,35B,38B,66C,80C,90C 'remot':43B 'run':32B 'sourc':40B 'system':34B,56B,89C 'user':47B,91C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the modem component of a device, so it applies to the phone or device model covered by the vendor's bulletin. The sources do not name affected models or versions. An attacker must already hold System privilege on the device, so an ordinary app without that access is not the target.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","modem","unknown"],"first_public_at":"2026-11-02T03:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20599","severity":null,"published_at":"2026-11-02T03:17:37+00:00","modified_at":"2026-11-02T03:17:37+00:00","first_seen_at":"2026-11-02T03:31:26+00:00","fetched_at":"2026-11-02T03:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}