CVE-2025-20760: Mediatek Nr15 DoS Vulnerability

CVE-2025-20760 Overview

CVE-2025-20760 is a denial of service vulnerability affecting MediaTek modem firmware across a wide range of chipsets. The vulnerability exists in the modem component where an uncaught exception leads to the reading of uninitialized heap data. This flaw can be exploited remotely when a user equipment (UE) device connects to a rogue base station controlled by an attacker, requiring no user interaction or additional execution privileges.

Critical Impact

Remote denial of service attack possible through rogue base station exploitation, affecting mobile connectivity across numerous MediaTek-powered devices without requiring any user interaction.

Affected Products

• MediaTek NR15, NR16, NR17 Modem Firmware
• MediaTek MT67xx Series (MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899)
• MediaTek MT69xx Series (MT6980, MT6983, MT6985, MT6986, MT6989, MT6990, MT6991, MT6993)
• MediaTek MT27xx Series (MT2735, MT2737)
• MediaTek MT87xx Series (MT8673, MT8675, MT8676, MT8678, MT8755, MT8771, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893)

Discovery Timeline

• 2026-01-06 - CVE-2025-20760 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-20760

Vulnerability Analysis

This vulnerability (CWE-617: Reachable Assertion) occurs within the MediaTek modem firmware when processing cellular network communications. The root issue stems from improper exception handling that allows the modem to read uninitialized heap data during certain operations. When a device connects to a malicious base station, the attacker can trigger conditions that cause the modem to access memory regions containing uninitialized data, leading to a denial of service condition.

The vulnerability is particularly concerning because it can be exploited remotely over the network without requiring any user interaction. An attacker would need to set up a rogue cellular base station and entice or force a victim's device to connect to it, after which the attack can be executed automatically.

Root Cause

The vulnerability originates from an uncaught exception in the MediaTek modem firmware's processing logic. When specific network signaling conditions are triggered, the modem fails to properly handle exceptional cases, resulting in the reading of uninitialized heap memory. This uninitialized memory access causes undefined behavior that manifests as a denial of service, disrupting the device's cellular connectivity.

The issue is tracked internally by MediaTek as Patch ID: MOLY01676750 and Issue ID: MSV-4653.

Attack Vector

The attack vector for this vulnerability involves the following scenario:

1. An attacker deploys a rogue cellular base station within range of potential victim devices
2. The victim's device, equipped with a vulnerable MediaTek modem chipset, connects to the rogue base station
3. The attacker sends specially crafted network signaling that triggers the uncaught exception condition
4. The modem attempts to read uninitialized heap data, causing a denial of service
5. The victim experiences loss of cellular connectivity until the device recovers or is restarted

This attack requires no user interaction once the device connects to the malicious base station, and no additional execution privileges are needed beyond the ability to operate the rogue infrastructure.

Detection Methods for CVE-2025-20760

Indicators of Compromise

• Unexpected modem crashes or restarts without apparent cause
• Repeated loss of cellular connectivity in specific geographic areas
• Modem firmware logs showing exception handling failures or memory access errors
• Unusual base station connection patterns or connections to unrecognized cell towers

Detection Strategies

• Monitor device logs for modem subsystem crashes or exceptions related to heap memory operations
• Implement network monitoring to detect suspicious base station behavior or unexpected cell tower handoffs
• Deploy mobile device management (MDM) solutions to track firmware versions and identify vulnerable devices
• Analyze modem diagnostic logs for patterns consistent with exploitation attempts

Monitoring Recommendations

• Enable comprehensive logging for modem subsystem events on managed devices
• Implement alerting for unusual patterns of device connectivity issues within monitored fleets
• Track firmware update status across devices to ensure vulnerable modems are patched
• Consider geofencing or network attestation solutions to detect rogue base station scenarios

How to Mitigate CVE-2025-20760

Immediate Actions Required

• Identify all devices using affected MediaTek chipsets within your organization's inventory
• Apply the security patch referenced in the MediaTek Security Bulletin January 2026 as soon as available from device OEMs
• Prioritize patching for devices used in sensitive locations or by personnel handling critical information
• Consider restricting device usage in areas with higher risk of rogue base station deployment until patches are applied

Patch Information

MediaTek has released a patch to address this vulnerability, identified as Patch ID: MOLY01676750. Organizations should monitor their device OEMs for firmware updates that incorporate this fix. The official security bulletin is available at the MediaTek Product Security Bulletin for January 2026.

Device manufacturers integrating MediaTek chipsets will need to incorporate this modem firmware update into their device update packages. End users should apply device system updates as they become available from their device manufacturers.

Workarounds

• Avoid connecting to unknown or untrusted cellular networks where possible
• Enable airplane mode when in high-risk areas if cellular connectivity is not essential
• Use Wi-Fi connectivity as an alternative when available to reduce exposure to potential rogue base station attacks
• Consider deploying mobile threat defense solutions that can detect and alert on suspicious network behavior