CVE-2025-20750: Mediatek Nr15 DOS Vulnerability

CVE-2025-20750 Overview

CVE-2025-20750 is a denial of service vulnerability affecting MediaTek modem firmware across numerous chipsets. The vulnerability exists in the Modem component where improper input validation leads to a possible system crash. When a User Equipment (UE) connects to a rogue base station controlled by an attacker, the malformed input can trigger a null pointer dereference (CWE-476), causing the device to crash without requiring any user interaction or additional execution privileges.

This vulnerability is classified as MEDIUM severity with a CVSS 3.1 score of 5.3, utilizing the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. The attack complexity is rated as High because it requires the victim device to connect to a malicious base station, but once this condition is met, exploitation requires no user interaction.

Critical Impact
Remote denial of service affecting mobile devices with vulnerable MediaTek modem chipsets when connected to a rogue base station controlled by an attacker.

Affected Products

MediaTek NR15 (5G modem software)
MediaTek MT2735
MediaTek MT6833 / MT6833P
MediaTek MT6853 / MT6853T
MediaTek MT6855 / MT6855T
MediaTek MT6873
MediaTek MT6875 / MT6875T
MediaTek MT6877 / MT6877T / MT6877TT
MediaTek MT6880
MediaTek MT6883
MediaTek MT6885
MediaTek MT6889
MediaTek MT6890
MediaTek MT6891
MediaTek MT6893
MediaTek MT8675
MediaTek MT8771
MediaTek MT8791 / MT8791T
MediaTek MT8797

Discovery Timeline

December 2, 2025 - CVE-2025-20750 published to NVD
December 4, 2025 - Last updated in NVD database

Technical Details for CVE-2025-20750

Vulnerability Analysis

The vulnerability resides in MediaTek's modem firmware, specifically affecting the processing of cellular network signaling. The flaw is tracked internally by MediaTek as Patch ID: MOLY01661199 and Issue ID: MSV-4296.

With a CVSS 3.1 base score of 5.3, the vulnerability characteristics indicate:

Attack Vector (AV:N): Network-based attack
Attack Complexity (AC:H): High complexity requiring specific conditions (rogue base station connection)
Privileges Required (PR:L): Low privileges needed
User Interaction (UI:N): No user interaction required
Scope (S:U): Unchanged scope
Confidentiality (C:N): No confidentiality impact
Integrity (I:N): No integrity impact
Availability (A:H): High availability impact (system crash)

The EPSS (Exploit Prediction Scoring System) data indicates a probability of 0.249% with a 48.098 percentile ranking, suggesting a relatively low likelihood of exploitation in the wild at this time.

Root Cause

The root cause is improper input validation (CWE-476 - Null Pointer Dereference) in the modem firmware. When processing specific signaling data from a cellular base station, the modem firmware fails to properly validate input parameters before dereferencing pointers. This allows a malicious base station to send crafted signaling messages that cause the modem to attempt to dereference a null pointer, resulting in a system crash.

The affected MT68xx and MT87xx series chipsets are widely deployed in smartphones and tablets, making this vulnerability particularly concerning for mobile device security.

Attack Vector

The attack requires an adversary to operate a rogue cellular base station (often called a "fake cell tower" or "IMSI catcher"). When a vulnerable device connects to this malicious base station, the attacker can send specially crafted signaling messages that exploit the improper input validation flaw. The attack flow is as follows:

Attacker deploys a rogue base station with stronger signal strength than legitimate towers
Victim device with vulnerable MediaTek modem automatically connects to the rogue station
Attacker sends malformed signaling data to the connected device
Modem firmware fails to validate the input, triggering a null pointer dereference
Device experiences a system crash, causing denial of service

No additional execution privileges are needed by the attacker, and the victim does not need to interact with the device for exploitation to succeed. This makes the attack particularly stealthy in scenarios where rogue base stations can be deployed near targeted locations.

Detection Methods for CVE-2025-20750

Indicators of Compromise

Unexpected device crashes or reboots when in specific geographic locations
Modem firmware crash logs indicating null pointer exceptions in signaling handlers
Unusual cellular network connection behavior or repeated reconnection attempts
System logs showing modem subsystem failures correlated with cellular network activity

Detection Strategies

Device-Level Monitoring:
Organizations should implement mobile device management (MDM) solutions capable of monitoring device health and crash reports. Correlation of modem crashes with location data may help identify areas where rogue base stations are operating.

Network Anomaly Detection:
While the attack occurs at the cellular layer, enterprise security teams can monitor for devices that experience repeated unexplained reboots or connectivity issues, which may indicate exploitation attempts.

Firmware Version Verification:
Regularly audit deployed MediaTek-based devices to ensure modem firmware has been updated with the patch MOLY01661199. Use device management tools to query firmware versions and flag devices running vulnerable software.

Monitoring Recommendations

Configure MDM solutions to alert on repeated device crashes or modem restarts
Implement centralized logging for mobile device health metrics
Monitor for patterns of device instability in specific geographic areas
Track firmware versions across the device fleet to identify vulnerable systems
Consider using cellular network security solutions that can detect rogue base stations in corporate environments

How to Mitigate CVE-2025-20750

Immediate Actions Required

Apply the MediaTek security patch (MOLY01661199) as soon as device OEMs release updated firmware
Check device manufacturer websites for security bulletins incorporating the MediaTek December 2025 patch
Prioritize patching for devices used in high-security environments or sensitive locations
Consider restricting cellular connectivity for critical devices in untrusted environments until patches are applied

Patch Information

MediaTek has released a security patch identified as MOLY01661199 (Issue ID: MSV-4296) to address this vulnerability. The patch is documented in MediaTek's December 2025 Product Security Bulletin, available at: https://corp.mediatek.com/product-security-bulletin/December-2025

Device owners should check with their device manufacturers (OEMs) for firmware updates that incorporate this patch, as MediaTek provides fixes to OEMs who then distribute updates to end users. The timeline for receiving patches depends on individual OEM update schedules.

Workarounds

Until patches are available, organizations can implement the following mitigating measures:

Physical Security:
In highly sensitive environments, consider RF shielding or controlled access to prevent rogue base station deployment near critical facilities.

Device Policy Restrictions:
Where feasible, configure devices to prefer Wi-Fi calling over cellular in trusted environments, reducing exposure to cellular-based attacks.

User Awareness:
Educate users about the risks of rogue base stations and instruct them to report any unusual device behavior, particularly unexpected crashes or reboots in specific locations.

Network Monitoring:
Deploy cellular intrusion detection systems in critical facilities to identify potential rogue base stations before they can affect devices.

Note that complete mitigation requires applying the official firmware patch, as there is no configuration change that can fully address the underlying null pointer dereference vulnerability in the modem firmware.