Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Mediatek modem firmware may expose data without encryption

CVE-2021-40148 · published 4 years ago
Summary

Mediatek modem models L9, LR11, LR12 and LR12A can send information without encrypting it, allowing anyone on the network to see that data. This can happen without any user interaction or special permissions. Apply the vendor’s security update or patch to ensure data is encrypted before transmission.

What to do
  • Update google :unknown: to version SoCVersion:2022-01-05.
Affected software
Ecosystem VendorProductAffected versions
Android google :unknown: >= SoCVersion:0, < SoCVersion:2022-01-05
Fix: upgrade to SoCVersion:2022-01-05
– mediatek l9 All versions
cpe:2.3:o:mediatek:l9:*:*:*:*:*:*:*:*
– mediatek lr11 All versions
cpe:2.3:o:mediatek:lr11:-:*:*:*:*:*:*:*
– mediatek lr12 All versions
cpe:2.3:o:mediatek:lr12:-:*:*:*:*:*:*:*
– mediatek lr12a All versions
cpe:2.3:o:mediatek:lr12a:-:*:*:*:*:*:*:*
– mediatek lr13 All versions
cpe:2.3:o:mediatek:lr13:-:*:*:*:*:*:*:*
– mediatek nr15 All versions
cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:*
Original advisory text
In Modem EMM, there is a possible information disclosure due to a missing data encryption. This could lead to remote information disclosure with no additional execution privileges needed. User inte...
In Modem EMM, there is a possible information disclosure due to a missing data encryption. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-319Cleartext Transmission of Sensitive Information
Timeline
Published1 Jan 2022
Updated4 Nov 2026
First seen10 Sep 2026
Sources
ASB-A-204728248 · OSV
CVE-2021-40148 · NVD
Track software like this
Free during beta