CVE-2026-66085
5.5MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-20
Impact
A local attacker with low privileges can read sensitive modem data exposed in crash dumps. They require local access to the device to extract the unredacted dump files.
Root cause
The modem firmware fails to sanitize or filter sensitive data before writing it to crash dump logs.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Apply the vendor modem firmware patch provided in Unisoc advisory 2109454821805424641, or restrict filesystem permissions to crash dump directories to prevent low-privileged users from reading them.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.