CVE-2025-11132: Google Android DOS Vulnerability

CVE-2025-11132 Overview

CVE-2025-11132 is a high-severity improper input validation vulnerability affecting the NR modem component in Unisoc chipsets running on Google Android devices. The vulnerability exists in the modem firmware and can be exploited remotely to cause a system crash, resulting in denial of service conditions. No additional execution privileges or user interaction are required for exploitation, making this vulnerability particularly concerning for mobile device security.

The vulnerability carries a CVSS 3.1 score of 7.5, with a network-based attack vector that requires low complexity to exploit. According to the EPSS (Exploit Prediction Scoring System), there is a 0.153% probability of exploitation, placing it at the 36.6th percentile of scored vulnerabilities.

Critical Impact

Remote attackers can exploit this vulnerability to cause system crashes on affected Android devices with Unisoc chipsets, leading to denial of service without requiring any authentication or user interaction.

Affected Products

• Google Android 13.0, 14.0, 15.0, and 16.0
• Unisoc T8100 chipset
• Unisoc T8200 chipset
• Unisoc T8300 chipset
• Unisoc T9100 chipset

Discovery Timeline

• 2025-12-01 - CVE-2025-11132 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-11132

Vulnerability Analysis

The vulnerability resides within the NR (New Radio) modem component of Unisoc chipsets, specifically in how the modem firmware processes incoming network data. The NR modem handles 5G cellular communications and is a critical component responsible for managing radio frequency operations, baseband processing, and network protocol handling.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates:

• Network Attack Vector (AV:N): Exploitation can occur remotely over the network
• Low Attack Complexity (AC:L): No special conditions required for exploitation
• No Privileges Required (PR:N): Attacker does not need authentication
• No User Interaction (UI:N): Victim does not need to perform any action
• High Availability Impact (A:H): Complete denial of service possible

Root Cause

The root cause of CVE-2025-11132 stems from improper input validation within the NR modem firmware. The modem component fails to adequately validate input data received through network communications, allowing specially crafted data to trigger unexpected behavior. When malformed or malicious input reaches the vulnerable code path, it causes the system to crash due to unhandled exceptions or resource exhaustion scenarios.

This class of vulnerability is particularly dangerous in modem firmware because the modem operates at a low level in the device stack and has direct access to hardware resources. When the modem crashes, it can cause cascading failures that result in a complete device reboot or prolonged unresponsiveness.

Attack Vector

The attack can be executed remotely over the cellular network without requiring physical access to the target device. An attacker could potentially craft malicious network packets or signaling messages that are processed by the vulnerable NR modem component. The lack of proper input validation allows these malformed packets to reach critical code paths and trigger the denial of service condition.

The vulnerability mechanism involves malformed data being passed to the NR modem's input processing routines. Due to insufficient bounds checking and validation, the malicious input causes memory corruption or resource exhaustion that leads to a system crash. For detailed technical information, refer to the Unisoc Security Advisory.

Detection Methods for CVE-2025-11132

Indicators of Compromise

• Unexpected device reboots or crashes, particularly during cellular network activity
• Modem crash logs in Android system diagnostics (/data/vendor/modem_dump/)
• Unusual network traffic patterns targeting modem signaling protocols
• Repeated modem subsystem restart events in system logs

Detection Strategies

Organizations can implement detection strategies focusing on anomaly detection for mobile device behavior. SentinelOne Singularity Mobile provides real-time threat detection capabilities that can identify abnormal device behavior associated with denial of service attacks on mobile devices.

Key detection approaches include:

• Monitoring for unusual patterns of device crashes or reboots
• Analyzing modem crash dumps for signatures associated with input validation failures
• Implementing network-level monitoring for malformed cellular signaling traffic
• Leveraging endpoint detection and response (EDR) solutions with mobile device management integration

Monitoring Recommendations

Security teams should implement comprehensive monitoring for affected Android devices with Unisoc chipsets. This includes:

1. Enable crash reporting and centralized logging for mobile device fleets
2. Monitor device health telemetry for patterns indicating potential exploitation attempts
3. Implement alerting for multiple consecutive device restarts within short time periods
4. Review modem firmware version inventory to identify devices requiring updates
5. Use SentinelOne Singularity Mobile to gain visibility into mobile device security posture

How to Mitigate CVE-2025-11132

Immediate Actions Required

• Check device firmware versions against the affected Unisoc chipset models (T8100, T8200, T8300, T9100)
• Apply vendor-provided security patches as soon as they become available from device manufacturers
• Monitor Unisoc and Google Android security bulletins for patch releases
• Consider network segmentation to limit exposure of vulnerable devices
• Deploy SentinelOne Singularity Mobile for enhanced visibility and protection on mobile device fleets

Patch Information

Unisoc has released a security advisory addressing this vulnerability. Device manufacturers and carriers are responsible for distributing firmware updates to end-user devices. Users and administrators should:

1. Check for system updates through the device's Settings > System > Software Update
2. Contact device manufacturers for specific patch availability timelines
3. Monitor the official Unisoc security announcement at: https://www.unisoc.com/en/support/announcement/1995394837938163714

Organizations managing fleets of affected devices should coordinate with their mobile device management (MDM) solutions to track patch deployment status across their device inventory.

Workarounds

As this vulnerability affects low-level modem firmware, direct workarounds are limited. However, organizations can implement compensating controls:

Reducing exposure through network-level protections:

• Implement network monitoring and anomaly detection for cellular traffic
• Consider restricting affected devices from high-risk network environments until patched
• Enable any available carrier-level security features
• Prioritize critical business devices for immediate patching when updates become available

Organizations should also maintain an accurate inventory of devices using affected Unisoc chipsets to enable rapid response when patches are released. SentinelOne Singularity Platform provides comprehensive asset visibility that can help identify vulnerable devices across enterprise mobile fleets.