CVE-2025-20667: MediaTek LR12A Information Disclosure Flaw

CVE-2025-20667 Overview

CVE-2025-20667 is an information disclosure vulnerability in MediaTek modem firmware caused by incorrect error handling. This flaw allows attackers operating a rogue base station to remotely extract sensitive information from user equipment (UE) without requiring any user interaction or additional execution privileges.

Critical Impact

Attackers can silently exfiltrate sensitive data from mobile devices using rogue cellular base stations, affecting over 80 MediaTek chipsets used in smartphones and tablets worldwide.

Affected Products

• MediaTek MT67xx Series (MT6739, MT6761-MT6799, MT6833-MT6991)
• MediaTek MT87xx Series (MT8666-MT8797)
• MediaTek Modem Firmware (LR12A, LR13, NR15, NR16, NR17, NR17R)

Discovery Timeline

• May 5, 2025 - CVE-2025-20667 published to NVD
• February 17, 2026 - Last updated in NVD database

Technical Details for CVE-2025-20667

Vulnerability Analysis

This vulnerability (tracked as Patch ID: MOLY01513293 and Issue ID: MSV-2741) resides in MediaTek's modem component, which handles cellular communication protocols. The flaw stems from inadequate cryptographic strength (CWE-326) in conjunction with improper error handling routines within the modem firmware.

When a device connects to a cellular base station, the modem performs various cryptographic and protocol negotiations. The vulnerability exists because error conditions during these negotiations are not handled securely, allowing an attacker-controlled base station to manipulate error responses and extract confidential information from the device.

The attack requires no privileges on the target device and can be executed without any user interaction, making it particularly dangerous in public areas where users might unknowingly connect to malicious cellular infrastructure.

Root Cause

The root cause of CVE-2025-20667 is inadequate cryptographic strength (CWE-326) combined with incorrect error handling in the modem's protocol implementation. When certain error conditions occur during cellular handshake or data exchange processes, the modem firmware fails to properly sanitize or suppress sensitive information in its responses. This allows an attacker operating a rogue base station to craft specific protocol messages that trigger these error conditions and harvest the leaked data.

Attack Vector

The attack leverages the network-based attack vector through rogue base station infrastructure. An attacker deploys a fake cellular tower (often called an IMSI catcher or Stingray) that mimics legitimate cellular network signals. When a vulnerable device with an affected MediaTek chipset connects to this rogue base station, the attacker can:

1. Intercept the initial connection handshake
2. Send malformed or crafted protocol messages to trigger error conditions
3. Analyze error responses from the modem that contain leaked sensitive information
4. Extract data without the device user's knowledge or interaction

The attack is particularly effective because it exploits fundamental cellular protocol behaviors, and users have no visual indication that they've connected to a malicious base station rather than a legitimate carrier tower.

Detection Methods for CVE-2025-20667

Indicators of Compromise

• Unusual cellular network disconnections and reconnections in device logs
• Device connecting to unexpected cell tower identifiers (Cell IDs) not associated with legitimate carriers
• Anomalous modem error logs indicating repeated protocol negotiation failures
• Network traffic patterns showing connections to base stations with abnormally strong signal strength in unexpected locations

Detection Strategies

• Monitor enterprise mobile device management (MDM) solutions for unusual cellular connectivity patterns
• Implement cellular network anomaly detection systems that can identify rogue base stations based on signal characteristics
• Review modem diagnostic logs on affected devices for error handling anomalies matching MOLY01513293 patterns
• Deploy RF spectrum monitoring in sensitive facilities to detect unauthorized cellular infrastructure

Monitoring Recommendations

• Enable verbose logging for cellular modem events on managed mobile devices where supported
• Utilize SentinelOne's mobile threat defense capabilities to monitor for anomalous network behaviors
• Establish baseline cellular connectivity patterns for organizational devices to detect deviations
• Consider implementing cellular protocol monitoring at the network edge for high-security environments

How to Mitigate CVE-2025-20667

Immediate Actions Required

• Apply the MediaTek security patch referenced in the MediaTek Security Bulletin - May 2025 immediately
• Contact device OEMs (smartphone/tablet manufacturers) for firmware updates incorporating the MOLY01513293 patch
• Restrict device use in high-risk areas where rogue base stations may be deployed until patching is complete
• Consider using WiFi calling where available to reduce exposure to cellular-based attacks

Patch Information

MediaTek has released a security patch identified as MOLY01513293 to address this vulnerability. The patch corrects the error handling logic in the modem firmware to prevent information leakage during error conditions. Device manufacturers (OEMs) must integrate this patch into their firmware updates for end-user deployment.

Organizations should check with their device vendors for availability of firmware updates containing this fix. The official security advisory is available at the MediaTek Product Security Bulletin.

Workarounds

• Avoid connecting to cellular networks in locations where rogue base stations are suspected until devices are patched
• Use airplane mode in sensitive locations and rely on secured WiFi networks when possible
• Implement enterprise mobile threat defense solutions to detect and alert on suspicious cellular behaviors
• Consider temporary deployment of shielded or Faraday-protected communication areas for highly sensitive operations

# Check Android device for MediaTek chipset (requires ADB access)
adb shell cat /proc/cpuinfo | grep -i mediatek
adb shell getprop ro.hardware

# Review modem logs for error patterns (device-specific, requires root)
adb shell logcat -b radio | grep -i "error\|MOLY"