CVE-2025-20644: Mediatek Nr15 DOS Vulnerability

CVE-2025-20644 Overview

CVE-2025-20644 is a memory corruption vulnerability affecting MediaTek modem firmware due to incorrect error handling. This vulnerability exists in the modem component of numerous MediaTek chipsets used in smartphones and tablets. When a user equipment (UE) device connects to a rogue base station controlled by an attacker, the improper error handling can trigger memory corruption leading to a denial of service condition.

The vulnerability is particularly concerning because it requires no user interaction and no special execution privileges for exploitation. An attacker who operates a malicious cellular base station can remotely cause affected devices to crash or become unresponsive, disrupting cellular connectivity for victims within range of the rogue tower.

Critical Impact
Remote denial of service attack possible through rogue base station - no user interaction required and affects over 40 MediaTek chipsets used in mobile devices worldwide.

Affected Products

MediaTek NR15 and NR16 (5G modem software)
MediaTek Dimensity chipsets (MT6833, MT6853, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6980, MT6983, MT6985, MT6989, MT6990 series)
MediaTek standalone modem chips (MT2735, MT2737)
MediaTek tablet chipsets (MT8673, MT8791T, MT8795T, MT8798)

Discovery Timeline

March 3, 2025 - CVE-2025-20644 published to NVD
April 22, 2025 - Last updated in NVD database

Technical Details for CVE-2025-20644

Vulnerability Analysis

This vulnerability stems from improper input validation within the modem firmware (CWE-1286: Improper Validation of Syntactically Incorrect Input). The modem component fails to properly handle malformed or unexpected data during cellular communication, specifically when processing signaling messages from base stations.

When a device connects to a rogue base station, the attacker can send specially crafted cellular protocol messages that trigger an error condition in the modem. Due to the incorrect error handling implementation, this error condition leads to memory corruption within the modem subsystem, ultimately causing a denial of service.

The attack occurs at the baseband/modem level, which operates independently from the main application processor. This means the vulnerability affects the fundamental cellular communication capability of the device, and exploitation could result in complete loss of cellular connectivity until the device is restarted.

Root Cause

The root cause is incorrect error handling within the MediaTek modem firmware. When the modem receives malformed data or encounters an unexpected condition during cellular protocol processing, the error handling code does not properly validate or sanitize the input before processing. This leads to a condition where memory structures can become corrupted.

The specific issue is tracked internally by MediaTek as Patch ID MOLY01525673 and Issue ID MSV-2747. The vulnerability exists in the protocol handling layers of the modem that process messages from cellular base stations, where input validation was insufficient for certain error scenarios.

Attack Vector

The attack requires the adversary to operate a rogue cellular base station within radio frequency range of the target device. The attack sequence involves:

The attacker sets up a malicious base station that mimics a legitimate cellular tower
When a vulnerable device connects to this rogue base station, the attacker sends specially crafted signaling messages
These malformed messages trigger the error handling flaw in the modem firmware
Memory corruption occurs, causing the modem to crash or become unresponsive
The victim loses cellular connectivity and may need to restart their device

This attack can be executed remotely via the network interface with no special privileges required by the attacker beyond the capability to operate radio equipment. The victim does not need to perform any actions - simply being within range of the rogue base station and having their device attempt to connect is sufficient.

Detection Methods for CVE-2025-20644

Indicators of Compromise

Unexpected loss of cellular connectivity without environmental explanation
Device modem crashes or restarts recorded in system logs
Repeated baseband/radio interface errors in device diagnostics
Unusual cellular network behavior or unexpected cell tower handoffs

Detection Strategies

Monitor device logs for modem subsystem crashes or unexpected restarts
Implement cellular network anomaly detection to identify suspicious base stations
Deploy endpoint detection solutions capable of monitoring baseband behavior
Review system crash reports for patterns indicating modem memory corruption

Monitoring Recommendations

Enable detailed logging on mobile device management (MDM) platforms to capture cellular connectivity issues
Monitor for clusters of devices experiencing simultaneous connectivity problems in specific geographic areas
Implement network-level detection for rogue base station activity using IMSI catcher detection techniques
Configure alerting for abnormal modem restart patterns across managed device fleets

How to Mitigate CVE-2025-20644

Immediate Actions Required

Apply the latest firmware updates from device manufacturers that incorporate MediaTek's patch MOLY01525673
Contact device vendors to confirm patch availability for affected MediaTek chipsets
Prioritize updates for devices used in sensitive environments or by high-value targets
Consider temporarily restricting cellular connectivity for critical devices in untrusted RF environments

Patch Information

MediaTek has released a security patch identified as MOLY01525673 to address this vulnerability. The patch is documented in the MediaTek Security Bulletin for March 2025. Device manufacturers (OEMs) must integrate this patch into their firmware updates and distribute them to end users.

Users should check with their device manufacturer for the availability of firmware updates that include this fix. The patch timeline depends on each OEM's update schedule and certification process with cellular carriers.

Workarounds

Avoid connecting to unknown or untrusted cellular networks when possible
Use Wi-Fi connectivity as an alternative in high-risk environments where rogue base stations may be present
Enable airplane mode when in areas where rogue cellular infrastructure is suspected
Deploy enterprise mobile threat defense solutions that can detect anomalous cellular behavior

bash

# Check device firmware version on Android
# Navigate to Settings > About phone > Software information
# Or use ADB command:
adb shell getprop ro.build.display.id

# Verify modem firmware version
adb shell getprop gsm.version.baseband