CVE-2026-20435

MEDIUM

4.6

Beschreibung

In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.

CVE Details

CVSS v3.1 Bewertung4.6

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AngriffsvektorPHYSICAL

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/2/2026

Zuletzt geandert3/3/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

google:androidlinuxfoundation:yoctomediatek:mt2737mediatek:mt6739mediatek:mt6761mediatek:mt6765mediatek:mt6768mediatek:mt6781mediatek:mt6789mediatek:mt6813mediatek:mt6833mediatek:mt6853mediatek:mt6855mediatek:mt6877mediatek:mt6878mediatek:mt6879mediatek:mt6880mediatek:mt6885mediatek:mt6886mediatek:mt6890mediatek:mt6893mediatek:mt6895mediatek:mt6897mediatek:mt6983mediatek:mt6985mediatek:mt6989mediatek:mt6990mediatek:mt6993mediatek:mt8169mediatek:mt8186mediatek:mt8188mediatek:mt8370mediatek:mt8390mediatek:mt8676mediatek:mt8678mediatek:mt8696mediatek:mt8793openwrt:openwrtrdkcentral:rdk-bzephyrproject:zephyr

Schwachen (CWE)

CWE-522

Referenzen

https://corp.mediatek.com/product-security-bulletin/March-2026(security@mediatek.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.