A critical vulnerability in MediaTek modem chipsets allows an unauthenticated attacker to trigger a system crash, resulting in a remote denial of service.

The vulnerability, categorized as CWE-754, involves improper checking for unusual conditions within the modem firmware. An unauthenticated attacker can trigger this condition by hosting a rogue base station, causing the device to crash without requiring user interaction or elevated privileges.

The exploitation of this vulnerability leads to a remote denial of service, effectively disconnecting affected devices from cellular networks. Given the CVSS score of 7.5, this poses a significant risk to operational continuity, particularly for mobile-reliant business processes, field communication, and remote device management.

Immediate Action: Apply the vendor-supplied security patch (Patch ID: MOLY01311265) as provided in the January 2026 MediaTek product security bulletin.

Proactive Monitoring: Monitor device connectivity logs for frequent or unexplained modem resets, which may indicate interaction with an unauthorized base station.

Compensating Controls: Ensure device firmware remains updated to the latest manufacturer baseline and avoid connecting to untrusted or non-standard cellular network environments.

Public Exploit Available: Unknown.

This vulnerability presents a moderate to high risk to mobile device availability. Organizations utilizing hardware containing the listed MediaTek chipsets should prioritize the deployment of the MOLY01311265 patch to prevent potential denial of service attacks against their mobile fleet.