CVE-2026-20419: MediaTek Nbiot SDK

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

In wlan AP/STA firmware, there is a possible system becoming irresponsive due to an uncaught exception. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461663 / WCNCR00463309; Issue ID: MSV-4852.

Affected products

• MediaTek Nbiot SDK: up to and including 3.6
• MediaTek Software Development Kit: up to and including 7.6.7.2
• Openwrt Openwrt: version 19.07.0 only; version 21.02.0 only

Published 2026-02-02. Last modified 2026-06-17.