CVE-2026-20435

EPSS 0.12%
Veröffentlicht 02.03.2026 08:39:12
Zuletzt bearbeitet 03.03.2026 12:52:46
Erkennungen
Login

In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 9 VulnDex Vulnerability Enrichment 31

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linuxfoundation ≫ Yocto Version 4.0

   Mediatek ≫ Mt2737 Version -
   Mediatek ≫ Mt6739 Version -
   Mediatek ≫ Mt6761 Version -
   Mediatek ≫ Mt6765 Version -
   Mediatek ≫ Mt6768 Version -
   Mediatek ≫ Mt6781 Version -
   Mediatek ≫ Mt6789 Version -
   Mediatek ≫ Mt6813 Version -
   Mediatek ≫ Mt6833 Version -
   Mediatek ≫ Mt6853 Version -
   Mediatek ≫ Mt6855 Version -
   Mediatek ≫ Mt6877 Version -
   Mediatek ≫ Mt6878 Version -
   Mediatek ≫ Mt6879 Version -
   Mediatek ≫ Mt6880 Version -
   Mediatek ≫ Mt6885 Version -
   Mediatek ≫ Mt6886 Version -
   Mediatek ≫ Mt6890 Version -
   Mediatek ≫ Mt6893 Version -
   Mediatek ≫ Mt6895 Version -
   Mediatek ≫ Mt6897 Version -
   Mediatek ≫ Mt6983 Version -
   Mediatek ≫ Mt6985 Version -
   Mediatek ≫ Mt6989 Version -
   Mediatek ≫ Mt6990 Version -
   Mediatek ≫ Mt6993 Version -
   Mediatek ≫ Mt8169 Version -
   Mediatek ≫ Mt8186 Version -
   Mediatek ≫ Mt8188 Version -
   Mediatek ≫ Mt8370 Version -
   Mediatek ≫ Mt8390 Version -
   Mediatek ≫ Mt8676 Version -
   Mediatek ≫ Mt8678 Version -
   Mediatek ≫ Mt8696 Version -
   Mediatek ≫ Mt8793 Version -

Rdkcentral ≫ Rdk-b Version 2022q3

Rdkcentral ≫ Rdk-b Version 2024q1

Google ≫ Android Version 14.0

Google ≫ Android Version 15.0

Google ≫ Android Version 16.0 Update -

Openwrt ≫ Openwrt Version 21.02.0 Update -

Openwrt ≫ Openwrt Version 23.05.0 Update -

Zephyrproject ≫ Zephyr Version 3.7.0 Update -

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.12%	0.018

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
CISA-ADP	4.6	0.9	3.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://corp.mediatek.com/product-security-bulletin/March-2026

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-20435

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-20435

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-20435

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-20435