CVE-2025-11131: Google Android DOS Vulnerability

CVE-2025-11131 Overview

CVE-2025-11131 is a high-severity vulnerability affecting the NR modem component in multiple Unisoc chipsets running Google Android. The vulnerability stems from improper input validation in the modem firmware, which can be exploited to cause a system crash. This remote denial of service condition requires no additional execution privileges, making it particularly concerning for mobile device security.

Critical Impact

Remote attackers can exploit this improper input validation flaw to crash affected Android devices without requiring any special privileges or user interaction, potentially impacting device availability and cellular connectivity.

Affected Products

• Google Android 13.0, 14.0, 15.0, and 16.0
• Unisoc T8100 chipset
• Unisoc T8200 chipset
• Unisoc T8300 chipset
• Unisoc T9100 chipset

Discovery Timeline

• December 1, 2025 - CVE-2025-11131 published to NVD
• December 1, 2025 - Last updated in NVD database

Technical Details for CVE-2025-11131

Vulnerability Analysis

This vulnerability exists within the NR (New Radio) modem component of Unisoc chipsets. The NR modem handles 5G cellular communications and processes various network-related data packets. Due to insufficient validation of input data within the modem firmware, specially crafted input can trigger a system crash condition.

The attack can be performed remotely over the network without requiring any special privileges on the target device. No user interaction is required to exploit this vulnerability, meaning attackers can potentially crash affected devices simply by sending malicious network traffic. The vulnerability impacts system availability while not affecting confidentiality or integrity of data on the device.

Affected devices span multiple generations of Android operating systems (versions 13.0 through 16.0) when combined with Unisoc T8100, T8200, T8300, or T9100 chipsets, indicating a widespread hardware-level issue in the modem firmware.

Root Cause

The root cause of CVE-2025-11131 is improper input validation within the NR modem firmware. When the modem receives and processes certain network data, it fails to properly validate the input before processing. This lack of boundary checking or data validation allows malformed or unexpected input to reach code paths that cannot handle such data gracefully, resulting in a system crash rather than proper error handling.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can remotely send specially crafted data to the NR modem of an affected device. The modem processes this data without proper validation, leading to an unhandled condition that crashes the entire system.

The attack characteristics include:

• No authentication required to exploit
• No user interaction needed
• Remote exploitation possible over cellular networks
• Results in denial of service through system crash

Due to the nature of the vulnerability affecting modem firmware, the attack likely involves manipulating cellular network protocols or signaling messages that are processed by the NR modem component.

Detection Methods for CVE-2025-11131

Indicators of Compromise

• Unexpected device reboots or system crashes occurring without user-initiated actions
• Correlation of crashes with cellular network activity or specific network conditions
• Modem-related crash logs in Android system diagnostics showing abnormal termination
• Multiple devices in the same network area experiencing simultaneous crashes

Detection Strategies

• Monitor device crash reports and system logs for patterns indicating modem-related failures
• Analyze modem firmware logs for abnormal input processing or error conditions
• Implement network traffic monitoring at the cellular infrastructure level to identify anomalous signaling patterns
• Deploy endpoint detection solutions capable of monitoring modem subsystem behavior

Monitoring Recommendations

• Enable comprehensive crash reporting on affected Android devices to capture modem-related failures
• Configure centralized logging for mobile device fleets to identify patterns across multiple devices
• Monitor for unusual network activity targeting cellular communication channels
• Establish baselines for normal device uptime and alert on anomalous crash frequencies

How to Mitigate CVE-2025-11131

Immediate Actions Required

• Check device firmware versions to determine if affected Unisoc chipsets are present
• Review the Unisoc Security Announcement for available patches
• Apply security updates from device manufacturers as they become available
• Consider restricting device deployment in high-risk network environments until patched

Patch Information

Unisoc has published a security announcement regarding this vulnerability. Organizations should consult the Unisoc Security Announcement for specific patch information and update guidance. Device manufacturers using affected Unisoc chipsets should integrate the modem firmware fixes into their Android security updates.

Users and administrators should apply the latest available security updates from their device manufacturers, as modem firmware updates are typically distributed through over-the-air (OTA) system updates.

Workarounds

• No permanent workarounds are available; applying the vendor-provided patch is the recommended solution
• Implement network-level monitoring to detect and potentially block attack traffic patterns
• Maintain device monitoring to quickly identify and respond to exploitation attempts
• Consider temporary deployment of backup devices for critical communications until patches are applied