CVE-2021-40148

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-04 · updated 2026-06-17
Weakness: CWE-319

Description

In Modem EMM, there is a possible information disclosure due to a missing data encryption. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00716585; Issue ID: ALPS05886933.

Affected products

Mediatek L9: all versions
Mediatek Lr11: all versions
Mediatek Lr12: all versions
Mediatek Lr12A: all versions
Mediatek Lr13: all versions
Mediatek Nr15: all versions

References

https://corp.mediatek.com/product-security-bulletin/January-2022
https://corp.mediatek.com/product-security-bulletin/January-2022

Get alerted when CVE-2021-40148 or the next vulnerability affects your stack