CVE-2025-11133 Overview
CVE-2025-11133 is a high-severity vulnerability affecting the NR modem component in Google Android devices utilizing Unisoc chipsets. The vulnerability stems from improper input validation in the modem firmware, which can lead to a system crash. This flaw enables remote attackers to trigger a denial of service condition without requiring any additional execution privileges or user interaction.
The vulnerability is particularly concerning as it can be exploited remotely over the network, potentially allowing attackers to disrupt cellular communications on affected devices. With a CVSS score of 7.5, this vulnerability poses a significant risk to device availability and could impact critical communications.
Critical Impact
Remote attackers can cause system crashes on affected Android devices with Unisoc chipsets, leading to denial of service without requiring any privileges or user interaction.
Affected Products
- Google Android 13.0, 14.0, 15.0, and 16.0
- Unisoc T8100 chipset
- Unisoc T8200 chipset
- Unisoc T8300 chipset
- Unisoc T9100 chipset
Discovery Timeline
- 2025-12-01 - CVE-2025-11133 published to NVD
- 2025-12-02 - Last updated in NVD database
Technical Details for CVE-2025-11133
Vulnerability Analysis
This vulnerability exists within the NR (New Radio) modem component, which handles 5G cellular communications on devices using Unisoc chipsets. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates that the attack can be launched remotely over the network with low complexity, requires no privileges or user interaction, and results in high availability impact.
The Exploit Prediction Scoring System (EPSS) assigns this vulnerability a probability score of 0.153%, placing it at the 36.6th percentile. While exploitation is not currently observed in the wild, the network-accessible attack vector and lack of required privileges make this vulnerability a candidate for opportunistic attacks.
Root Cause
The root cause of CVE-2025-11133 is improper input validation within the NR modem firmware. When processing network-based inputs, the modem fails to adequately validate incoming data before processing, allowing malformed or malicious input to trigger an unhandled exception or error condition. This lack of proper boundary checking or input sanitization leads to a crash state in the modem subsystem.
The vulnerability appears to be related to how the modem handles specific protocol messages or data structures during cellular communication, where unexpected or crafted input can cause the system to enter an unstable state.
Attack Vector
The attack vector for CVE-2025-11133 is network-based, meaning an attacker can potentially exploit this vulnerability by sending specially crafted data to the target device over cellular networks or other network interfaces that interact with the modem subsystem.
The exploitation scenario involves sending malformed network packets or protocol messages that bypass standard validation checks in the NR modem firmware. When the modem processes this malicious input, the improper input validation allows the attack to succeed, causing the device to crash or become unresponsive.
Since no verified proof-of-concept code is publicly available for this vulnerability, the specific exploitation mechanism has not been disclosed. Security researchers should refer to the Unisoc vendor advisory for additional technical details regarding the vulnerability trigger conditions.
Detection Methods for CVE-2025-11133
Indicators of Compromise
- Unexpected device crashes or reboots, particularly when connected to cellular networks
- Modem subsystem errors or failures reported in device logs
- Abnormal cellular connection behavior or repeated disconnections
- System instability following receipt of unusual network traffic
Detection Strategies
Organizations can implement several detection strategies to identify potential exploitation attempts:
Log Monitoring: Monitor device crash logs and modem subsystem logs for patterns indicating improper input handling or unexpected exceptions. Look for modem-related crash dumps or kernel panic events that coincide with network activity.
Network Analysis: While detecting specific exploitation traffic may be challenging without detailed protocol knowledge, monitoring for unusual cellular protocol anomalies or unexpected traffic patterns directed at affected devices can provide early warning indicators.
Endpoint Detection: SentinelOne Singularity Platform provides behavioral analysis capabilities that can detect system instability patterns and anomalous device behavior that may indicate exploitation attempts targeting mobile device components.
Monitoring Recommendations
- Enable detailed logging on Android devices to capture modem subsystem events
- Monitor for patterns of repeated system crashes across device fleets
- Implement alerting for unusual modem-related errors in centralized device management systems
- Track device stability metrics to identify potential exploitation campaigns targeting multiple devices
How to Mitigate CVE-2025-11133
Immediate Actions Required
- Review the Unisoc security advisory at https://www.unisoc.com/en/support/announcement/1995394837938163714 for patch availability
- Apply security updates from Google and Unisoc as soon as they become available
- Inventory all devices using affected Unisoc chipsets (T8100, T8200, T8300, T9100)
- Monitor affected devices for signs of system instability or unexpected crashes
- Consider network segmentation to limit exposure of vulnerable devices where possible
Patch Information
Unisoc has acknowledged this vulnerability and published a security advisory. Organizations and users should apply the latest firmware updates for affected Unisoc chipsets and install Android security updates that address this vulnerability. The vendor advisory is available at:
Device manufacturers using Unisoc chipsets should work with their supply chain to distribute patched firmware to end users. Enterprise administrators should prioritize updating devices running Android 13.0 through 16.0 on affected Unisoc hardware.
Workarounds
While no official workarounds have been published for this vulnerability, the following defensive measures may help reduce exposure:
Since this vulnerability requires network access to exploit, organizations can implement network-level controls to monitor and filter suspicious traffic where feasible. However, given the nature of cellular modem vulnerabilities, complete mitigation without patching may be limited.
For critical environments, consider temporarily reducing the attack surface by:
- Disabling unnecessary network services on affected devices
- Using mobile device management (MDM) solutions to enforce security policies
- Implementing network monitoring to detect anomalous behavior
- Maintaining up-to-date backups of device configurations
The most effective mitigation is applying vendor-provided security patches as soon as they become available from device manufacturers and carriers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
