CVE-2025-20791 Overview
CVE-2025-20791 is a Denial of Service vulnerability affecting the MediaTek Modem component across numerous MediaTek chipsets. The vulnerability stems from incorrect error handling in the modem firmware, which can lead to a system crash when a User Equipment (UE) device connects to a rogue base station controlled by an attacker.
This vulnerability is particularly concerning because it requires no user interaction for exploitation and no additional execution privileges. An attacker operating a malicious base station could trigger the vulnerability remotely, causing affected devices to crash and become temporarily unavailable.
Critical Impact
Remote denial of service attack possible through rogue base station connection, affecting mobile devices with vulnerable MediaTek chipsets without requiring user interaction.
Affected Products
- MediaTek NR15
- MediaTek MT2735
- MediaTek MT6833/MT6833P
- MediaTek MT6853/MT6853T
- MediaTek MT6855/MT6855T
- MediaTek MT6873
- MediaTek MT6875/MT6875T
- MediaTek MT6877/MT6877T/MT6877TT
- MediaTek MT6880
- MediaTek MT6883
- MediaTek MT6885
- MediaTek MT6889
- MediaTek MT6890
- MediaTek MT6891
- MediaTek MT6893
- MediaTek MT8675
- MediaTek MT8771
- MediaTek MT8791/MT8791T
- MediaTek MT8797
Discovery Timeline
- December 2, 2025 - CVE-2025-20791 published to NVD
- December 3, 2025 - Last updated in NVD database
Technical Details for CVE-2025-20791
Vulnerability Analysis
CVE-2025-20791 is classified under CWE-617 (Reachable Assertion), which describes a condition where the product contains an assertion that can be triggered by an attacker. In this case, the MediaTek modem firmware contains improper error handling logic that fails to gracefully manage unexpected conditions during cellular network communications.
The vulnerability carries a CVSS v3.1 score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. This indicates:
- Attack Vector (AV:N): Network-based attack
- Attack Complexity (AC:H): High complexity required (rogue base station setup)
- Privileges Required (PR:L): Low privileges needed
- User Interaction (UI:N): No user interaction required
- Scope (S:U): Unchanged scope
- Confidentiality (C:N): No confidentiality impact
- Integrity (I:N): No integrity impact
- Availability (A:H): High availability impact
The EPSS (Exploit Prediction Scoring System) data shows a probability of 0.214% with a percentile ranking of 44.01%, indicating a moderate likelihood of exploitation in the wild.
Root Cause
The root cause of this vulnerability lies in the modem's error handling implementation. When the modem receives malformed or unexpected data from a base station, the error handling routines fail to properly validate and process the error conditions. Instead of gracefully recovering or ignoring the malformed input, the modem triggers an assertion or unhandled exception that results in a system crash.
This type of reachable assertion vulnerability (CWE-617) typically occurs when:
- Assertions intended for debugging are left in production code
- Error conditions are not properly anticipated in network protocol handling
- Input validation is insufficient for edge cases in cellular communication protocols
Attack Vector
The attack requires an adversary to operate a rogue base station within radio range of the target device. When a vulnerable device connects to this malicious base station, the attacker can send specially crafted cellular protocol messages that trigger the incorrect error handling in the modem firmware.
The attack scenario involves:
- The attacker sets up a rogue base station (IMSI catcher or similar infrastructure)
- The target device with a vulnerable MediaTek chipset connects to the rogue base station
- The attacker sends malformed signaling messages through the rogue base station
- The modem's error handling fails to process the malformed data correctly
- An assertion or unhandled exception is triggered, causing the modem (and potentially the device) to crash
Since no user interaction is required, devices may automatically connect to the strongest available signal, making this attack particularly effective in areas where the attacker can establish signal dominance.
Detection Methods for CVE-2025-20791
Indicators of Compromise
- Unexpected device reboots or crashes, particularly in areas with potentially compromised cellular infrastructure
- Modem crash logs indicating assertion failures or unhandled exceptions
- Unusual cellular network behavior or connection patterns
- Crash dump files referencing modem firmware components
- System logs showing repeated modem subsystem restarts
Detection Strategies
Organizations can implement the following detection strategies:
Device Monitoring: Deploy mobile device management (MDM) solutions that can collect and analyze device crash reports, specifically monitoring for modem-related crashes.
Network Anomaly Detection: Monitor for unusual cellular network patterns that might indicate the presence of rogue base stations in the environment.
Firmware Version Auditing: Regularly audit device firmware versions to identify devices running vulnerable MediaTek modem firmware prior to patch ID MOLY01661189.
Crash Report Analysis: Implement automated analysis of device crash reports to identify patterns consistent with CVE-2025-20791 exploitation.
Monitoring Recommendations
Security teams should:
- Enable detailed logging on mobile devices where possible
- Implement centralized crash report collection for enterprise-managed devices
- Monitor for geographic clusters of device crashes that might indicate rogue base station activity
- Utilize cellular network monitoring tools to detect anomalous base station behavior
- Consider deploying IMSI catcher detection solutions in sensitive environments
How to Mitigate CVE-2025-20791
Immediate Actions Required
- Apply the security patch identified as MOLY01661189 from MediaTek through OEM firmware updates
- Check with device manufacturers for available security updates addressing this vulnerability
- Monitor the MediaTek Product Security Bulletin for December 2025 for additional guidance
- Identify all devices in your environment using affected MediaTek chipsets
- Prioritize patching for devices used in sensitive environments or by high-value targets
Patch Information
MediaTek has released a patch to address this vulnerability:
- Patch ID: MOLY01661189
- Issue ID: MSV-4298
- Advisory URL: https://corp.mediatek.com/product-security-bulletin/December-2025
Device manufacturers (OEMs) using affected MediaTek chipsets should integrate this patch into their firmware updates. End users should check with their device manufacturers for security updates that include this fix.
Workarounds
While awaiting patch deployment, consider the following workarounds:
Avoid High-Risk Areas: Users should be cautious when operating devices in areas where rogue base stations may be present, such as high-security targets, protest areas, or regions with known surveillance activity.
Enable Airplane Mode: In sensitive situations, enabling airplane mode will prevent the device from connecting to any base station, including rogue ones.
Use Alternative Communication Methods: Where possible, rely on Wi-Fi-based communication instead of cellular when in potentially compromised environments.
Device Selection: For new device procurement, verify that devices include firmware with patch MOLY01661189 applied.
# Check device chipset information (Android)
adb shell getprop ro.hardware
adb shell getprop ro.board.platform
# Review modem logs for crash indicators
adb logcat -b radio | grep -i "crash\|assert\|exception"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
