CVE-2025-20667 Overview
CVE-2025-20667 is a remote information disclosure vulnerability in the MediaTek modem firmware. The flaw stems from incorrect error handling in the modem subsystem and can be triggered when a User Equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation requires no user interaction and no additional execution privileges. The issue affects a broad range of MediaTek 4G/5G modem chipsets and platforms used in smartphones, IoT devices, and embedded systems. MediaTek tracks the fix under Patch ID MOLY01513293 and Issue ID MSV-2741, and published the advisory in its May 2025 Product Security Bulletin. The vulnerability is categorized under [CWE-326] (Inadequate Encryption Strength).
Critical Impact
A network-adjacent attacker operating a rogue base station can remotely extract sensitive modem information from affected devices without any user interaction.
Affected Products
- MediaTek modem platforms: LR12A, LR13, NR15, NR16, NR17, NR17R
- MediaTek smartphone SoCs including MT6739, MT6761–MT6789, MT6833/MT6853, MT6873–MT6899, and MT6980–MT6991
- MediaTek IoT/automotive SoCs including MT2735, MT2737, MT8666–MT8797
Discovery Timeline
- 2025-05-05 - CVE-2025-20667 published to NVD
- 2026-02-17 - Last updated in NVD database
Technical Details for CVE-2025-20667
Vulnerability Analysis
The vulnerability resides in the MediaTek modem stack, which implements cellular protocol handling for 4G LTE and 5G NR connectivity. Incorrect error handling logic in the modem allows specific error conditions, triggered through crafted signaling from a rogue base station, to leak sensitive information back over the air interface. Because the modem trusts the network during pre-authentication signaling, an attacker can induce the targeted error paths without needing valid operator credentials. The disclosed data may include internal modem state or identifiers that aid in tracking or further attacks against the device. The CWE-326 classification indicates the underlying weakness relates to inadequate cryptographic strength or protection of the affected data path.
Root Cause
The modem firmware fails to properly handle error conditions during cellular signaling exchanges. When the attacker-controlled base station drives the UE into the faulty error path, the modem's response exposes information that should remain confidential. MediaTek addresses the issue under Patch ID MOLY01513293.
Attack Vector
Exploitation requires the attacker to operate a rogue base station, such as a false NodeB/gNB, within radio range of the target device. The UE must attach or attempt to attach to the rogue cell, which is achievable using IMSI catcher hardware or software-defined radio platforms running open-source cellular stacks. Once the UE engages with the malicious network, the attacker sends signaling messages that drive the modem into the vulnerable error handler. No application-level interaction, user prompts, or elevated privileges on the device are required. Because the attack operates at the baseband layer, the host operating system has no direct visibility into the exploitation.
Detection Methods for CVE-2025-20667
Indicators of Compromise
- Unexpected cell reselection or attach events to unknown PLMN identifiers or cells with anomalous tracking area codes.
- Increased frequency of authentication failures, RRC connection resets, or NAS protocol errors logged on managed mobile devices.
- Devices repeatedly downgrading to weaker radio access technologies near non-operator-affiliated cell sites.
Detection Strategies
- Monitor mobile device management (MDM) telemetry for firmware/baseband versions that do not include the MediaTek May 2025 patch level.
- Deploy rogue base station detection capabilities, such as SeaGlass-style sensors or carrier-supplied IMSI catcher detection, in sensitive locations.
- Correlate location data with anomalous signaling events to identify possible rogue cell coverage areas around offices, executive residences, or travel routes.
Monitoring Recommendations
- Track baseband and modem firmware versions across the fleet and flag devices missing the May 2025 MediaTek security patch level.
- Alert on devices that frequently camp on non-allowlisted cell IDs or experience repeated NAS/RRC error sequences.
- Review carrier-side signaling logs for anomalies consistent with false base station activity in high-risk geographies.
How to Mitigate CVE-2025-20667
Immediate Actions Required
- Apply the MediaTek-supplied firmware update referencing Patch ID MOLY01513293 through your device OEM as soon as it is available.
- Inventory all devices using affected MediaTek chipsets and prioritize patch deployment for high-value users such as executives and engineering staff.
- Restrict use of unpatched devices in environments where rogue base station activity is plausible, including travel to high-risk regions.
Patch Information
MediaTek published the fix in its May 2025 Product Security Bulletin under Patch ID MOLY01513293 and Issue ID MSV-2741. Device manufacturers must integrate the modem update into their OEM firmware releases. See the MediaTek Security Bulletin May 2025 for the full list of affected chipsets and patch references.
Workarounds
- Disable 2G/legacy fallback on devices that support the option to reduce exposure to common rogue base station techniques.
- Enforce VPN usage on mobile devices so that higher-layer traffic remains protected even if baseband signaling is manipulated.
- Use carrier or enterprise-grade mobile threat defense tooling capable of alerting on suspicious cellular network conditions.
# Example: verify Android baseband/firmware version against the May 2025 patch level
adb shell getprop ro.build.version.security_patch
adb shell getprop gsm.version.baseband
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
