CVE-2025-20725 Overview
CVE-2025-20725 is an out-of-bounds write vulnerability [CWE-787] in the MediaTek IP Multimedia Subsystem (IMS) service. The flaw stems from a missing bounds check that allows an attacker operating a rogue base station to write outside allocated memory on a connected User Equipment (UE). Successful exploitation enables remote escalation of privilege without user interaction. The vulnerability affects a broad range of MediaTek modem and SoC platforms spanning 4G LTE and 5G NR devices. MediaTek disclosed the issue in its November 2025 Product Security Bulletin and assigned Patch ID MOLY01671924 (Issue ID MSV-4620).
Critical Impact
An attacker controlling a rogue base station can corrupt memory in the IMS service on a connected device and escalate privileges remotely with no user interaction required.
Affected Products
- MediaTek modems: LR12A, NR15, NR16
- MediaTek smartphone chipsets: MT6739, MT6761–MT6771 series, MT6833/MT6853/MT6855, MT6873/MT6875/MT6877/MT6879, MT6883/MT6885/MT6886/MT6889/MT6891/MT6893, MT6895/MT6896, MT6980/MT6983/MT6985/MT6989/MT6990
- MediaTek automotive and IoT chipsets: MT2735, MT2737, MT8666/MT8667/MT8673/MT8675, MT8765/MT8766/MT8768/MT8771, MT8786/MT8788/MT8791/MT8795T/MT8797/MT8798/MT8893
Discovery Timeline
- 2025-11-04 - CVE-2025-20725 published to NVD
- 2025-11-05 - Last updated in NVD database
Technical Details for CVE-2025-20725
Vulnerability Analysis
The vulnerability resides in the IMS service of the MediaTek modem (Modem Layer, also known as MOLY) firmware. IMS handles signaling for Voice over LTE (VoLTE), Voice over New Radio (VoNR), and related multimedia services exchanged between the UE and the carrier core network. A code path within the IMS handler fails to validate the length of attacker-controlled data before copying it into a fixed-size buffer. This results in an out-of-bounds write [CWE-787] in the modem address space.
The attack is launched over the radio interface by impersonating a legitimate base station. Because IMS messages are parsed before strong authentication completes in certain control plane paths, a malicious eNodeB or gNodeB can deliver malformed payloads that trigger the overflow. The corruption can be leveraged to alter modem control structures and gain elevated execution within the modem.
Root Cause
The root cause is a missing bounds check in an IMS message parser. The affected function trusts a length field or implicit terminator in attacker-supplied data and writes past the destination buffer. This is a classic input validation failure in cellular baseband code, mapped to [CWE-787] Out-of-Bounds Write.
Attack Vector
Exploitation requires the attacker to operate a rogue base station within radio range and convince the target UE to attach to it. Once attached, the attacker sends crafted IMS signaling that reaches the vulnerable parser. No user interaction is needed, and the high attack complexity reflects the operational effort to deploy a rogue base station and force UE attachment. Technical details of the exploitation primitive are not public; see the MediaTek Security Bulletin November 2025 for vendor information.
Detection Methods for CVE-2025-20725
Indicators of Compromise
- Unexpected modem resets, IMS service crashes, or repeated VoLTE/VoNR registration failures on affected devices.
- Device logs showing attachment to unknown PLMN identifiers or cells with anomalous signal characteristics inconsistent with the operator footprint.
- Sudden downgrades from 5G NR to LTE or from LTE to 2G/3G in geographies where this is unexpected.
Detection Strategies
- Use mobile threat defense or carrier-side analytics to flag UEs attaching to cells with suspicious Cell IDs, TACs, or that lack proper network authentication.
- Correlate modem crash telemetry (tombstones, ramdumps referencing IMS components) with location and cell attachment data to identify potential exploitation attempts.
- Monitor enterprise mobile device management (MDM) inventories to confirm patch levels reflect the November 2025 MediaTek bulletin.
Monitoring Recommendations
- Centralize mobile device logs and baseband crash reports into a security data lake for longitudinal analysis.
- Track IMS registration anomalies and forced RAT (Radio Access Technology) downgrades across the fleet.
- Alert on devices running firmware that predates the November 2025 MediaTek security patch level.
How to Mitigate CVE-2025-20725
Immediate Actions Required
- Apply the MediaTek November 2025 security patch (Patch ID MOLY01671924) as soon as it is delivered through the device OEM's firmware update channel.
- Inventory all devices using affected MediaTek chipsets and prioritize updates for high-risk users such as executives and field personnel.
- For high-risk users in untrusted radio environments, disable VoLTE/VoNR or restrict the device to known carrier networks until patches are installed.
Patch Information
MediaTek released the fix in its November 2025 Product Security Bulletin under Patch ID MOLY01671924 and Issue ID MSV-4620. Device manufacturers must integrate the modem firmware update into their respective Android security patch levels and distribute it to end users. Refer to the MediaTek Security Bulletin November 2025 for full details.
Workarounds
- Where supported, configure devices to prefer LTE/5G only and disable legacy fallback to reduce the attack surface for rogue base station attachment.
- Educate users to avoid unknown or unexpected cellular service degradations and to report frequent dropped calls or forced network re-registrations.
- Use enterprise policy to enforce minimum patch levels and block non-compliant devices from accessing corporate resources until updated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
