CVE-2026-20455: High severity geniezone vulnerability
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6784.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS10873936 - Compensating control
Because exploitation may enable local escalation of privilege without user interaction after System privilege is obtained, restrict/monitor access to obtain System privilege (e.g., limit who/what can reach or use paths that grant System privilege) until the ALPS10873936 patch is applied.
- Operational
After applying ALPS10873936, review relevant system logs for evidence of exploitation tied to issue MSV-6784 (local OOB write), and remediate/rotate any credentials or tokens that may be impacted if exploitation is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20455?
The severity of CVE-2026-20455 is high with a CVSS score of 7.8.
How do I fix CVE-2026-20455?
You can fix CVE-2026-20455 by applying the patch identified as ALPS10873936.
What systems are affected by CVE-2026-20455?
CVE-2026-20455 affects the geniezone software as well as several MediaTek firmware versions including Mt6739, Mt6761, Mt6765, Mt6768, Mt6781, Mt6789, and Mt6835.
What type of attack does CVE-2026-20455 facilitate?
CVE-2026-20455 facilitates local escalation of privilege if a malicious actor has already obtained System privilege.
Is user interaction required to exploit CVE-2026-20455?
No, user interaction is not required to exploit CVE-2026-20455.