CVE-2025-20793: MediaTek NR15 Modem DoS Vulnerability

CVE-2025-20793 Overview

CVE-2025-20793 is a denial of service vulnerability affecting the modem component in numerous MediaTek chipsets. The vulnerability exists due to incorrect error handling within the modem firmware, which can result in a null pointer dereference (CWE-476). When a User Equipment (UE) device connects to a rogue base station controlled by an attacker, the improper error handling can trigger a system crash, leading to remote denial of service.

This vulnerability is particularly concerning because it requires no user interaction and no additional execution privileges to exploit. An attacker operating a malicious base station can remotely crash affected devices, disrupting cellular connectivity and potentially impacting critical communications.

Critical Impact

Remote denial of service affecting mobile devices and tablets using MediaTek modem chipsets when connected to attacker-controlled rogue base stations. No user interaction or special privileges required for exploitation.

Affected Products

• MediaTek NR15, NR16, NR17, NR17R (5G NR modem firmware)
• MediaTek MT67xx series chipsets (MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6983, MT6985, MT6989, MT6990, MT6991, MT6993)
• MediaTek MT27xx series chipsets (MT2735, MT2737)
• MediaTek MT87xx series chipsets (MT8673, MT8675, MT8676, MT8678, MT8755, MT8771, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893)

Discovery Timeline

• January 6, 2026 - CVE-2025-20793 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-20793

Vulnerability Analysis

This vulnerability stems from improper error handling in MediaTek's modem component. When the modem processes certain cellular signaling messages from a base station, it fails to properly validate or handle error conditions, resulting in a null pointer dereference. The vulnerability is tracked internally by MediaTek as Patch ID: MOLY01430930 and Issue ID: MSV-4836.

The attack requires the victim device to connect to a rogue base station, which could be achieved through various cellular protocol manipulation techniques. Once connected, the attacker can send specially crafted signaling that triggers the improper error handling path, causing the modem subsystem to crash and potentially forcing a device reboot.

Root Cause

The root cause is a null pointer dereference (CWE-476) in the modem firmware's error handling code path. When specific error conditions are encountered during cellular protocol processing, the code fails to properly check for null pointers before dereferencing them. This leads to an unrecoverable fault in the modem processor, causing a system crash.

Attack Vector

The attack is network-based and can be executed remotely without any user interaction or special privileges. The attack scenario involves:

1. An attacker deploys a rogue cellular base station (fake cell tower)
2. The attacker configures the base station to attract victim devices through signal strength manipulation or other techniques
3. When a vulnerable device connects to the rogue base station, the attacker sends malformed or specially crafted signaling messages
4. The modem firmware's improper error handling triggers a null pointer dereference
5. The device experiences a system crash or denial of service condition

The vulnerability affects devices using 4G LTE and 5G NR connectivity, given the wide range of affected chipsets spanning multiple generations of MediaTek modem hardware.

Detection Methods for CVE-2025-20793

Indicators of Compromise

• Unexpected device reboots or crashes when in areas with potentially hostile cellular infrastructure
• Repeated modem subsystem failures visible in system logs
• Anomalous cellular network behavior including unexpected cell tower handoffs
• Kernel panic or crash dump logs indicating modem-related faults

Detection Strategies

• Monitor device fleet for unusual patterns of modem crashes or device reboots correlated with geographic locations
• Implement cellular network anomaly detection to identify potential rogue base stations
• Review system logs for modem crash events with signatures matching null pointer dereference conditions
• Deploy mobile threat defense solutions capable of detecting abnormal cellular behavior

Monitoring Recommendations

• Enable comprehensive logging of modem subsystem events on managed mobile devices
• Implement centralized crash reporting to identify patterns indicative of exploitation attempts
• Monitor for security advisories from device manufacturers regarding firmware updates
• Track device inventory against the extensive list of affected MediaTek chipsets

How to Mitigate CVE-2025-20793

Immediate Actions Required

• Identify all devices in your environment using affected MediaTek chipsets
• Apply firmware updates from device manufacturers as they become available
• Consider restricting device usage in high-risk environments where rogue base stations may be present
• Implement mobile device management (MDM) policies to ensure rapid deployment of security patches

Patch Information

MediaTek has released a patch to address this vulnerability. The fix is tracked as Patch ID: MOLY01430930. Device manufacturers will incorporate this patch into their firmware updates. Users should monitor for security updates from their device vendors and apply them promptly.

For detailed information, refer to the MediaTek Security Bulletin January 2026.

Workarounds

• Avoid connecting to unknown or untrusted cellular networks when possible
• Use Wi-Fi connectivity in preference to cellular when in potentially hostile environments
• Enable airplane mode in high-risk areas if cellular connectivity is not essential
• Consider using devices with alternative modem chipsets for sensitive operations until patches are applied

# Check for affected MediaTek chipset on Android devices
# Run via ADB shell or terminal emulator
getprop ro.hardware
getprop ro.board.platform
cat /proc/cpuinfo | grep -i "hardware\|processor"