The vulnerability arises from a missing filter of sensitive data in crash dump files generated by the modem. Because the crash dumps are not sanitized, an unauthorized local user can read the files and obtain confidential information. This is a classic input handling weakness (CWE‑20). The flaw allows local information disclosure without requiring additional privileges or elevated execution rights.

The affected product is the Unisoc (Shanghai) Technologies Co., Ltd. Modem. No specific version scope is listed, so all firmware versions that contain the unfiltered crash dump functionality may be vulnerable.

The CVSS score of 5.5 places the vulnerability in the medium severity range. The EPSS score is not available, and it is not listed in CISA's KEV catalog, indicating no known exploitation campaigns. The attack vector is local; the attacker must have physical or local network access to the modem to obtain the crash dump files. No additional execution privileges are required beyond local access.