CVE-2025-20666: Mediatek Nr15 DoS Vulnerability

CVE-2025-20666 Overview

CVE-2025-20666 is a denial of service vulnerability affecting MediaTek modem components across a wide range of chipsets. The vulnerability exists in the modem firmware where an uncaught exception can cause a system crash when a user equipment (UE) connects to a rogue base station controlled by an attacker. This is classified as CWE-617 (Reachable Assertion), indicating improper handling of exceptional conditions in the modem's signal processing logic.

Critical Impact

Remote attackers operating rogue cellular base stations can trigger system crashes on vulnerable devices without any user interaction or additional privileges, potentially disrupting critical mobile communications.

Affected Products

• MediaTek NR15 Modem Software
• MediaTek MT2735, MT6833, MT6833P, MT6853, MT6853T, MT6855, MT6855T Chipsets
• MediaTek MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT Chipsets
• MediaTek MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893 Chipsets
• MediaTek MT8666, MT8667, MT8673, MT8675, MT8771, MT8791, MT8791T, MT8795T, MT8797, MT8798 Tablet/Chromebook Chipsets

Discovery Timeline

• May 5, 2025 - CVE-2025-20666 published to NVD
• May 12, 2025 - Last updated in NVD database

Technical Details for CVE-2025-20666

Vulnerability Analysis

This vulnerability stems from inadequate exception handling within the MediaTek modem firmware. When processing signals from a cellular base station, the modem fails to properly catch and handle specific exceptional conditions, resulting in an unhandled exception that propagates through the system and triggers a complete device crash.

The attack requires the victim device to connect to a malicious base station. In practical terms, this could occur when an attacker deploys a fake cellular tower (IMSI catcher or "stingray" device) that attracts nearby mobile devices. Once a vulnerable device establishes a connection, the attacker can transmit specially crafted signaling data that triggers the uncaught exception.

The vulnerability is particularly concerning because it requires no user interaction and no special privileges on the target device. The attack surface spans all devices using the affected MediaTek chipsets, which are commonly found in mid-range and budget Android smartphones, tablets, and Chromebooks.

Root Cause

The root cause is identified as CWE-617 (Reachable Assertion), where an assertion or exception condition within the modem firmware is reachable by external input but is not properly handled. The modem's signal processing code contains a code path that can trigger an exception when receiving malformed or unexpected data from a base station, but the exception handler is either missing or improperly configured, leading to a system crash rather than graceful error recovery.

The issue is tracked internally by MediaTek as Patch ID: MOLY00650610 and Issue ID: MSV-2933.

Attack Vector

The attack is network-based and exploits the cellular modem's connection to base stations. The exploitation scenario involves:

1. An attacker deploys a rogue base station (fake cell tower) in proximity to target devices
2. The rogue base station broadcasts signals to attract nearby mobile devices
3. When a vulnerable device connects to the rogue base station, the attacker sends crafted signaling messages
4. The modem firmware encounters an exceptional condition it cannot handle
5. The uncaught exception causes the device to crash, resulting in denial of service

This attack does not require any victim interaction—the device will automatically attempt to connect to the strongest available cellular signal, which could be the attacker's rogue base station. The vulnerability affects the baseband processor, making software-level protections ineffective.

Detection Methods for CVE-2025-20666

Indicators of Compromise

• Unexpected device reboots or crashes, particularly in areas with known cellular coverage
• Modem-related crash logs in device system diagnostics referencing assertion failures
• Patterns of device instability when moving through specific geographic areas where rogue base stations may be operating

Detection Strategies

• Monitor device logs for modem firmware crashes or assertion failures with signatures related to MOLY00650610 or MSV-2933
• Implement cellular network anomaly detection to identify potential rogue base station activity in enterprise environments
• Deploy mobile threat detection solutions that can identify abnormal cellular signaling patterns

Monitoring Recommendations

• Enable crash reporting on mobile devices to identify patterns of modem-related failures across your device fleet
• Use enterprise mobility management (EMM) solutions to track device stability metrics and identify affected devices
• Consider implementing cellular security solutions that can detect and alert on rogue base station presence

How to Mitigate CVE-2025-20666

Immediate Actions Required

• Inventory all devices using affected MediaTek chipsets (MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT8666, MT8667, MT8673, MT8675, MT8771, MT8791, MT8795T, MT8797, MT8798, MT2735, NR15)
• Apply security updates from device manufacturers that incorporate MediaTek's May 2025 security bulletin patches
• Prioritize updates for devices used in critical operations or sensitive environments

Patch Information

MediaTek has released a security patch addressing this vulnerability, tracked as Patch ID: MOLY00650610. The fix is documented in the MediaTek Security Bulletin for May 2025. Device manufacturers (OEMs) must integrate this patch into their firmware updates and distribute to end users.

Users should check with their device manufacturer for availability of security updates that include the May 2025 MediaTek security patches.

Workarounds

• Limit device use in untrusted environments where rogue base stations could be deployed (public events, protests, areas near sensitive facilities)
• Where possible, disable cellular connectivity and use Wi-Fi when in high-risk areas until patches are applied
• For enterprise environments, consider deploying cellular anomaly detection systems to identify potential rogue base station activity