CVE-2026-20435 (GCVE-0-2026-20435)
Vulnerability from cvelistv5
Published
2026-03-02 08:39
Modified
2026-03-30 13:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-522 - Insufficiently Protected Credentials
Summary
In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MediaTek chipset |
Version: MT2737 Version: MT6739 Version: MT6761 Version: MT6765 Version: MT6768 Version: MT6781 Version: MT6789 Version: MT6813 Version: MT6833 Version: MT6853 Version: MT6855 Version: MT6877 Version: MT6878 Version: MT6879 Version: MT6880 Version: MT6885 Version: MT6886 Version: MT6890 Version: MT6893 Version: MT6895 Version: MT6897 Version: MT6983 Version: MT6985 Version: MT6989 Version: MT6990 Version: MT6993 Version: MT8169 Version: MT8186 Version: MT8188 Version: MT8370 Version: MT8390 Version: MT8676 Version: MT8678 Version: MT8696 Version: MT8793 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-20435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-02T13:35:00.235194Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-02T13:35:04.764Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MediaTek chipset",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "MT2737"
},
{
"status": "affected",
"version": "MT6739"
},
{
"status": "affected",
"version": "MT6761"
},
{
"status": "affected",
"version": "MT6765"
},
{
"status": "affected",
"version": "MT6768"
},
{
"status": "affected",
"version": "MT6781"
},
{
"status": "affected",
"version": "MT6789"
},
{
"status": "affected",
"version": "MT6813"
},
{
"status": "affected",
"version": "MT6833"
},
{
"status": "affected",
"version": "MT6853"
},
{
"status": "affected",
"version": "MT6855"
},
{
"status": "affected",
"version": "MT6877"
},
{
"status": "affected",
"version": "MT6878"
},
{
"status": "affected",
"version": "MT6879"
},
{
"status": "affected",
"version": "MT6880"
},
{
"status": "affected",
"version": "MT6885"
},
{
"status": "affected",
"version": "MT6886"
},
{
"status": "affected",
"version": "MT6890"
},
{
"status": "affected",
"version": "MT6893"
},
{
"status": "affected",
"version": "MT6895"
},
{
"status": "affected",
"version": "MT6897"
},
{
"status": "affected",
"version": "MT6983"
},
{
"status": "affected",
"version": "MT6985"
},
{
"status": "affected",
"version": "MT6989"
},
{
"status": "affected",
"version": "MT6990"
},
{
"status": "affected",
"version": "MT6993"
},
{
"status": "affected",
"version": "MT8169"
},
{
"status": "affected",
"version": "MT8186"
},
{
"status": "affected",
"version": "MT8188"
},
{
"status": "affected",
"version": "MT8370"
},
{
"status": "affected",
"version": "MT8390"
},
{
"status": "affected",
"version": "MT8676"
},
{
"status": "affected",
"version": "MT8678"
},
{
"status": "affected",
"version": "MT8696"
},
{
"status": "affected",
"version": "MT8793"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T13:05:38.348Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/March-2026"
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2026-20435",
"datePublished": "2026-03-02T08:39:12.070Z",
"dateReserved": "2025-11-03T01:30:59.011Z",
"dateUpdated": "2026-03-30T13:05:38.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.6, \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-20435\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-02T13:35:00.235194Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-02T13:34:55.071Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"MediaTek, Inc.\", \"product\": \"MediaTek chipset\", \"versions\": [{\"status\": \"affected\", \"version\": \"MT2737\"}, {\"status\": \"affected\", \"version\": \"MT6739\"}, {\"status\": \"affected\", \"version\": \"MT6761\"}, {\"status\": \"affected\", \"version\": \"MT6765\"}, {\"status\": \"affected\", \"version\": \"MT6768\"}, {\"status\": \"affected\", \"version\": \"MT6781\"}, {\"status\": \"affected\", \"version\": \"MT6789\"}, {\"status\": \"affected\", \"version\": \"MT6813\"}, {\"status\": \"affected\", \"version\": \"MT6833\"}, {\"status\": \"affected\", \"version\": \"MT6853\"}, {\"status\": \"affected\", \"version\": \"MT6855\"}, {\"status\": \"affected\", \"version\": \"MT6877\"}, {\"status\": \"affected\", \"version\": \"MT6878\"}, {\"status\": \"affected\", \"version\": \"MT6879\"}, {\"status\": \"affected\", \"version\": \"MT6880\"}, {\"status\": \"affected\", \"version\": \"MT6885\"}, {\"status\": \"affected\", \"version\": \"MT6886\"}, {\"status\": \"affected\", \"version\": \"MT6890\"}, {\"status\": \"affected\", \"version\": \"MT6893\"}, {\"status\": \"affected\", \"version\": \"MT6895\"}, {\"status\": \"affected\", \"version\": \"MT6897\"}, {\"status\": \"affected\", \"version\": \"MT6983\"}, {\"status\": \"affected\", \"version\": \"MT6985\"}, {\"status\": \"affected\", \"version\": \"MT6989\"}, {\"status\": \"affected\", \"version\": \"MT6990\"}, {\"status\": \"affected\", \"version\": \"MT6993\"}, {\"status\": \"affected\", \"version\": \"MT8169\"}, {\"status\": \"affected\", \"version\": \"MT8186\"}, {\"status\": \"affected\", \"version\": \"MT8188\"}, {\"status\": \"affected\", \"version\": \"MT8370\"}, {\"status\": \"affected\", \"version\": \"MT8390\"}, {\"status\": \"affected\", \"version\": \"MT8676\"}, {\"status\": \"affected\", \"version\": \"MT8678\"}, {\"status\": \"affected\", \"version\": \"MT8696\"}, {\"status\": \"affected\", \"version\": \"MT8793\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://corp.mediatek.com/product-security-bulletin/March-2026\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-522\", \"description\": \"CWE-522 Insufficiently Protected Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"ee979b05-11f8-4f25-a7e0-a1fa9c190374\", \"shortName\": \"MediaTek\", \"dateUpdated\": \"2026-03-30T13:05:38.348Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-20435\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-30T13:05:38.348Z\", \"dateReserved\": \"2025-11-03T01:30:59.011Z\", \"assignerOrgId\": \"ee979b05-11f8-4f25-a7e0-a1fa9c190374\", \"datePublished\": \"2026-03-02T08:39:12.070Z\", \"assignerShortName\": \"MediaTek\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…