CVE-2024-20094
📋 TL;DR
This vulnerability in MediaTek modems allows remote attackers to cause a system crash (denial of service) without authentication or user interaction. It affects devices using vulnerable MediaTek modem firmware. The issue stems from missing bounds checking in modem software.
💻 Affected Systems
- MediaTek modem chipsets
📦 What is this software?
Nr15 by Mediatek
⚠️ Risk & Real-World Impact
Worst Case
Permanent modem failure requiring device reboot or factory reset, disrupting all cellular connectivity including emergency calls.
Likely Case
Temporary modem crash causing loss of cellular connectivity until automatic or manual reboot.
If Mitigated
No impact if patched; limited impact if network filtering blocks malicious packets.
🎯 Exploit Status
Remote exploitation requires sending specially crafted packets to modem interface
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patch ID: MOLY00843282
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/October-2024
Restart Required: Yes
Instructions:
1. Contact device manufacturer for firmware update 2. Apply modem firmware patch MOLY00843282 3. Reboot device
🔧 Temporary Workarounds
Network filtering
allBlock suspicious modem protocol traffic at network perimeter
🧯 If You Can't Patch
- Isolate affected devices from untrusted networks
- Monitor for modem crash events and implement rapid response procedures
🔍 How to Verify
Check if Vulnerable:
Check modem firmware version against MediaTek security bulletinCheck Version:
Device-specific; typically in Android: Settings > About Phone > Baseband VersionVerify Fix Applied:
Verify patch MOLY00843282 is applied in modem firmware version📡 Detection & Monitoring
Log Indicators:
- Modem crash logs
- Unexpected modem resets
- Baseband processor failure events
Network Indicators:
- Unusual modem protocol traffic patterns
- Spike in malformed packet attempts
SIEM Query:
Example: 'event_category:modem AND (event_type:crash OR event_type:reset)'