CVE-2025-20670: Mediatek Nr16 Auth Bypass Vulnerability

CVE-2025-20670 Overview

CVE-2025-20670 is an improper certificate validation vulnerability [CWE-295] in MediaTek modem firmware. The flaw allows a permission bypass that can lead to remote information disclosure when a user equipment (UE) device connects to a rogue base station controlled by an attacker. Exploitation requires low-level user execution privileges and user interaction, but no elevated permissions on the device. MediaTek tracks this issue as Patch ID MOLY01334347 and Issue ID MSV-2772. The vulnerability affects a broad range of MediaTek 5G modem and SoC platforms used in smartphones, tablets, and IoT devices.

Critical Impact
An attacker operating a rogue base station can bypass certificate validation in the modem stack and extract sensitive information from a connected UE, undermining a core trust boundary of the cellular network.

Affected Products

MediaTek 5G modems: NR16, NR17, NR17R
MediaTek smartphone SoCs including MT6835, MT6878, MT6879, MT6886, MT6895, MT6897, MT6983, MT6985, MT6989, MT6990, MT6991
MediaTek tablet and embedded SoCs including MT8666, MT8673, MT8676, MT8768, MT8781, MT8788, MT8791, MT8797, MT8798

Discovery Timeline

2025-05-05 - CVE-2025-20670 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20670

Vulnerability Analysis

The vulnerability resides in the MediaTek modem's certificate validation logic used during cellular network authentication procedures. The modem fails to properly validate certificates presented by the base station, allowing a rogue base station to pass authentication checks it should not satisfy. Once the UE trusts the malicious network element, protected information handled by the modem can be disclosed to the attacker. The issue is classified under CWE-295 (Improper Certificate Validation) and is remediated by MediaTek patch MOLY01334347.

Root Cause

The root cause is missing or incomplete verification of certificate properties within the modem firmware. When the modem parses certificate material presented during network attachment or a related protocol exchange, it does not enforce the checks required to distinguish a legitimate operator base station from an attacker-operated one. This weakens the cryptographic trust boundary between the UE and the serving network.

Attack Vector

Exploitation requires the attacker to operate a rogue base station within radio range of the target device. The victim must connect to that base station, which represents the required user interaction element. Once connected, the attacker leverages the certificate validation flaw to bypass permission checks and elicit information disclosure from the modem. The attack vector is Network, and no privileged access to the device is required beyond normal user execution context.

Because no verified proof-of-concept has been published, refer to the MediaTek Security Bulletin - May 2025 for authoritative technical detail.

Detection Methods for CVE-2025-20670

Indicators of Compromise

Unexpected cellular network reattachment events or downgrades in the mobile device's radio logs.
Presence of unknown base station identifiers (Cell ID, PLMN, TAC) inconsistent with the carrier's published infrastructure.
Anomalous modem-level authentication failures followed by successful attach to an unfamiliar cell.

Detection Strategies

Monitor mobile device management (MDM) telemetry for firmware versions of affected MediaTek chipsets that predate the MOLY01334347 patch.
Correlate device location with expected operator coverage to flag attachments to suspicious or transient cells.
Use cellular threat intelligence feeds and IMSI catcher detection tooling on high-risk devices to surface rogue base station activity.

Monitoring Recommendations

Track vendor firmware advisories from MediaTek and downstream OEMs to confirm patch adoption across the mobile fleet.
Log and review radio-layer events from enterprise-managed handsets, focusing on repeated cell changes and authentication anomalies.
Establish alerting on user reports of unexplained connectivity drops in areas served by well-known operators.

How to Mitigate CVE-2025-20670

Immediate Actions Required

Inventory devices using the affected MediaTek chipsets listed in the advisory and identify those still running pre-patch modem firmware.
Apply the OEM security update that incorporates MediaTek Patch ID MOLY01334347 as soon as it is available for each device model.
Instruct high-risk users to avoid connecting to unknown or unexpected cellular networks and to disable auto-attach behavior where feasible.

Patch Information

MediaTek addressed the flaw in the May 2025 Product Security Bulletin under Patch ID MOLY01334347 and Issue ID MSV-2772. OEMs consume this patch and ship it in their monthly device security updates. Refer to the MediaTek Security Bulletin - May 2025 and the corresponding OEM advisory for the specific firmware build that contains the fix for a given device.

Workarounds

Restrict sensitive devices to trusted networks such as Wi-Fi under enterprise control, or use VPNs to reduce the value of any modem-layer information disclosure.
Configure devices, where supported, to prefer 5G Standalone or LTE with strong authentication and to reject 2G fallback, which reduces exposure to rogue base station tactics.
Deploy MDM policies that block or alert on connections to unapproved carrier profiles and monitor for missing security patch levels.

bash

# Configuration example: query patch level on Android to verify fix adoption
adb shell getprop ro.build.version.security_patch
adb shell getprop gsm.version.baseband