The vulnerability resides in the modem’s input handling and can be triggered remotely without any privilege escalation. It is caused by improper input validation, which falls under CWE-20. An attacker that can reach the modem over the network can send malformed data that causes the hardware or firmware to crash or reboot, thereby denying legitimate users connectivity and availability. Because no additional privileges are required, even unauthenticated users could abuse the flaw. The installation of an unpatched firmware is sufficient to expose the device to this risk.

The products affected are Unisoc (Shanghai) Technologies Co., Ltd.’s modem series, including the T8100, T9100, T8200, and T8300 models. No specific firmware versions are listed, so all builds within these series are potentially affected.

The CVSS score of 7.5 indicates a high‑to‑critical severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, but a flaw of this type can still be exploited if the device is exposed to an untrusted network. The malicious payload can be delivered through normal data channels used by the modem, and because no authentication or elevated privileges are required, the attack vector is likely remote. While no public exploit code has been reported, the combination of high severity and remote reachability warrants swift remediation if possible.