CVE-2025-11132 Overview
CVE-2025-11132 is an improper input validation vulnerability in the 5G New Radio (NR) modem firmware used in UNISOC chipsets. The flaw allows a remote attacker to trigger a system crash without authentication or user interaction. Successful exploitation results in a denial of service condition affecting Android devices built on the affected UNISOC platforms. The vulnerability does not grant additional execution privileges, but it can disrupt cellular connectivity and device availability. Affected products span multiple Android versions and several UNISOC system-on-chip families. The vendor has acknowledged the issue through a security bulletin published on the UNISOC support portal.
Critical Impact
Remote attackers can crash the NR modem and cause denial of service on affected Android devices with no privileges or user interaction required.
Affected Products
- Google Android 13.0, 14.0, 15.0, and 16.0
- UNISOC T8100, T8200, T8300 chipsets
- UNISOC T9100 chipset
Discovery Timeline
- 2025-12-01 - CVE-2025-11132 published to NVD
- 2025-12-02 - Last updated in NVD database
Technical Details for CVE-2025-11132
Vulnerability Analysis
The vulnerability resides in the NR modem component that processes 5G New Radio signaling messages. The modem firmware fails to properly validate input before parsing it, leading to an unrecoverable error condition. An attacker within radio range, or one able to inject crafted signaling traffic through a rogue base station, can send malformed input that the modem cannot handle safely. The result is a modem crash that propagates into a system-level denial of service. Because the modem operates as a privileged radio component on the device, its failure disrupts cellular connectivity and may force a device reboot. The CWE classification is listed as NVD-CWE-noinfo, indicating the vendor did not publicly disclose the underlying weakness category.
Root Cause
The root cause is improper input validation [CWE-20] in the NR modem code path. The firmware assumes that incoming protocol fields conform to expected structures and ranges without enforcing sanity checks. When attacker-controlled input violates those assumptions, the modem enters an inconsistent state and crashes.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker capable of transmitting crafted 5G NR signaling, typically by operating a malicious base station or relay, can deliver the malformed input to any device within range. The attack targets the baseband processor directly rather than the Android user space.
No public proof-of-concept exploit is available. See the UniSoc Support Announcement for vendor-published technical details.
Detection Methods for CVE-2025-11132
Indicators of Compromise
- Unexpected modem resets or repeated baseband crash logs in device telemetry
- Sudden loss of cellular service followed by automatic device or radio reboots
- Kernel or radio interface layer (RIL) log entries referencing NR modem failures
Detection Strategies
- Monitor mobile device management (MDM) telemetry for fleet-wide patterns of modem crashes or connectivity loss correlated by location
- Correlate cellular signal anomalies with the presence of unauthorized base stations using rogue cell detection tools
- Review Android bug reports and logcat output for repeated radio subsystem failures on UNISOC-based devices
Monitoring Recommendations
- Enroll affected UNISOC-based Android devices in centralized logging to capture modem crash events
- Track Android security patch level (SPL) compliance across the device fleet to confirm remediation
- Alert on clusters of cellular disconnections that may indicate active denial of service attempts against the modem
How to Mitigate CVE-2025-11132
Immediate Actions Required
- Identify all devices running UNISOC T8100, T8200, T8300, or T9100 chipsets across the environment
- Apply the vendor-supplied modem firmware update referenced in the UNISOC advisory once available from the device OEM
- Subscribe to OEM and carrier security bulletins to receive over-the-air (OTA) patches as they ship
Patch Information
UNISOC has published a support announcement addressing this vulnerability. Device patches are delivered by handset OEMs through Android monthly security updates incorporating the vendor's modem firmware fix. Refer to the UniSoc Support Announcement for the authoritative patch reference.
Workarounds
- Disable 5G NR mode on affected devices and fall back to LTE where business requirements allow
- Restrict use of affected devices in untrusted radio environments until firmware patches are deployed
- Use carrier-grade rogue base station detection to limit exposure to malicious NR signaling sources
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.