CVE-2025-21452: Qualcomm 315 5G IoT Modem DOS Vulnerability

CVE-2025-21452 Overview

CVE-2025-21452 is a transient denial-of-service (DoS) vulnerability affecting a broad range of Qualcomm modem, Snapdragon, FastConnect, and connectivity firmware components. The flaw is triggered when the modem processes a Random Access Response (RAR) message containing an invalid Protocol Data Unit (PDU) length on an LTE network. Successful exploitation causes the modem to enter an unreachable state, disrupting cellular connectivity on the affected device. The issue is classified under [CWE-617] (Reachable Assertion) and is exploitable over the network without authentication or user interaction.

Critical Impact
A remote attacker within radio range can disrupt LTE connectivity on devices using affected Qualcomm chipsets by sending a malformed RAR message, impacting availability across phones, IoT modems, automotive modems, and 5G modem-RF systems.

Affected Products

Qualcomm Snapdragon Mobile Platforms (4 Gen 1, 480, 690, 695, 765, 778G, 780G, 855, 865, 870, 888, and related variants)
Qualcomm Modem-RF Systems (Snapdragon X35 5G, X55 5G, Auto 5G, 315 5G IoT Modem, SDX55, SDX57M)
Qualcomm FastConnect, QCA, WCD, WCN, and WSA connectivity firmware families

Discovery Timeline

2025-08-06 - CVE-2025-21452 published to NVD
2025-08-06 - Qualcomm Security Bulletin (August 2025) published
2025-08-20 - Last updated in NVD database

Technical Details for CVE-2025-21452

Vulnerability Analysis

The vulnerability resides in the LTE modem stack responsible for handling Random Access Response messages during the Random Access Procedure. When the modem parses an RAR Medium Access Control (MAC) PDU, it does not adequately validate the declared PDU length. A malformed length value triggers a reachable assertion or unrecoverable internal error, causing a transient denial of service in the modem subsystem.

Because the Random Access Procedure executes early in the LTE attach and resynchronization flow, the affected code path is reached without any authenticated session between the User Equipment (UE) and the base station. This makes the issue exploitable from any rogue eNodeB within radio range of the target device.

The impact is limited to availability. There is no indication of memory corruption, code execution, or information disclosure. Recovery typically requires the modem to reset or re-attach to the network.

Root Cause

The defect is a missing or insufficient bounds check on the PDU length field within RAR parsing logic, classified as [CWE-617] Reachable Assertion. Crafted length values that violate protocol expectations reach an assertion or fatal error path instead of being rejected gracefully and silently discarded.

Attack Vector

Exploitation requires the attacker to operate a malicious LTE base station (rogue eNodeB) or otherwise inject crafted RAR messages into the victim's air interface. When the targeted UE attempts the Random Access Procedure, the attacker responds with an RAR PDU containing an invalid length field. The vulnerable modem firmware then enters the faulty parsing path and triggers the DoS condition.

No verified public proof-of-concept code is available. Refer to the Qualcomm Security Bulletin August 2025 for vendor technical details.

Detection Methods for CVE-2025-21452

Indicators of Compromise

Repeated, unexplained LTE modem resets, baseband crashes, or radio re-attach events on affected devices.
Loss of cellular service in specific geographic areas, particularly where a rogue base station may be operating.
Modem diagnostic logs showing assertion failures or fatal errors in the LTE Random Access Procedure handler.

Detection Strategies

Collect and correlate modem crash logs and ramdumps from managed mobile and IoT fleets to identify clusters of LTE stack faults tied to RAR processing.
Monitor mobile device management (MDM) telemetry for spikes in cellular disconnects, baseband resets, or device-reported radio errors.
For operators of private LTE or IoT deployments, use radio-side monitoring to detect anomalous RAR messages with malformed PDU lengths.

Monitoring Recommendations

Track firmware version inventory across mobile, automotive, and IoT endpoints and flag devices still running pre-August 2025 Qualcomm firmware.
Establish a baseline for normal cellular reconnect rates per device class and alert on statistically significant deviations.
Forward modem and MDM telemetry into a centralized analytics platform to support cross-fleet correlation of DoS events.

How to Mitigate CVE-2025-21452

Immediate Actions Required

Identify all devices, vehicles, and IoT modems using affected Qualcomm chipsets and prioritize firmware updates for high-value or safety-critical assets.
Apply the OEM firmware update that incorporates Qualcomm's August 2025 fix as soon as it is released for each device model.
For mission-critical deployments, restrict reliance on a single LTE path and provide failover to alternative connectivity (Wi-Fi, 5G SA, wired) where possible.

Patch Information

Qualcomm addressed CVE-2025-21452 in the Qualcomm Security Bulletin August 2025. Patches are distributed to original equipment manufacturers (OEMs), who must integrate them into device-specific firmware images. End users should install the most recent vendor firmware or carrier update that references the August 2025 Qualcomm bulletin.

Workarounds

No software-level workaround exists on the device side because the vulnerable code executes inside modem firmware before higher-layer protections engage.
In controlled environments, operate sensitive devices within trusted private cellular networks or known-good macro coverage to reduce exposure to rogue base stations.
Where feasible, disable LTE and prefer 5G SA or non-cellular connectivity until firmware updates are deployed.

bash

# Example: check Android baseband/firmware versions across a fleet via adb
adb shell getprop gsm.version.baseband
adb shell getprop ro.build.version.release
adb shell getprop ro.product.model