CVE-2025-61607 Overview
CVE-2025-61607 is an improper input validation flaw in the Unisoc 5G New Radio (NR) modem firmware. The vulnerability affects Android devices running on Unisoc T8100, T8200, T8300, and T9100 chipsets across Android versions 13 through 16. An attacker can send crafted network traffic to trigger a system crash, resulting in remote denial of service. Exploitation requires no authentication, no user interaction, and no additional execution privileges.
Critical Impact
Remote attackers can crash the modem subsystem of affected Android devices over the network without authentication, disrupting cellular connectivity and device availability.
Affected Products
- Google Android 13.0, 14.0, 15.0, and 16.0
- Unisoc T8100 and T8200 chipsets
- Unisoc T8300 and T9100 chipsets
Discovery Timeline
- 2025-12-01 - CVE-2025-61607 published to NVD
- 2025-12-02 - Last updated in NVD database
Technical Details for CVE-2025-61607
Vulnerability Analysis
The vulnerability resides in the NR modem component used across multiple Unisoc system-on-chip platforms. The modem firmware fails to properly validate input received over the air interface. When malformed data reaches the affected processing path, the modem enters an unrecoverable state and crashes. This affects the cellular baseband, which directly impacts device availability for calls, messaging, and mobile data.
The issue carries a confidentiality and integrity impact of none, but the availability impact is high. Exploitation does not yield code execution or data exposure. Instead, the attack class falls under remote denial of service against the baseband processor.
Root Cause
The root cause is improper input validation within NR modem message handling. The firmware accepts attacker-controlled fields without enforcing expected bounds, types, or state constraints. When the parser encounters values outside its assumed range, the modem processes the input down a path that leads to a fatal fault. The Common Weakness Enumeration entry is listed as NVD-CWE-noinfo because Unisoc has not published detailed technical attribution.
Attack Vector
The attack vector is network-based and exploitable over the radio interface. An adversary with a rogue base station or signal injection capability can transmit malformed 5G NR signaling to a target handset. Because the modem processes radio signaling before any user-space authentication, no user interaction or device unlock is required. The vulnerability mechanism involves crafted NR signaling that bypasses validation checks in the modem firmware, triggering a crash in the baseband process. Refer to the Unisoc Support Announcement for vendor-specific technical context.
Detection Methods for CVE-2025-61607
Indicators of Compromise
- Unexpected modem restarts or loss of cellular service on devices using Unisoc T8100, T8200, T8300, or T9100 chipsets.
- Repeated baseband crash logs or modem_subsys reset entries in Android system logs.
- Anomalous NR signaling activity in proximity to affected devices, particularly from unauthorized base stations.
Detection Strategies
- Monitor Android device telemetry for repeated radio interface failures and modem reboot events.
- Correlate device crash reports with geographic clustering, which may indicate a rogue cell site.
- Review mobile device management (MDM) fleet health metrics for spikes in cellular disconnects on Unisoc-based devices.
Monitoring Recommendations
- Enable centralized collection of Android logcat and dmesg output from managed devices to capture baseband fault traces.
- Track Unisoc security bulletins and Android Security Bulletin updates for patch availability across affected chipsets.
- Establish alerting on repeated RIL (Radio Interface Layer) reset events that may indicate active exploitation attempts.
How to Mitigate CVE-2025-61607
Immediate Actions Required
- Inventory all managed Android devices using Unisoc T8100, T8200, T8300, and T9100 chipsets.
- Apply vendor patches as soon as device manufacturers publish updated firmware images.
- Prioritize patching for high-risk users and devices operating in regions with known rogue base station activity.
Patch Information
Unisoc has acknowledged the vulnerability through its support channel. Device manufacturers must integrate the corrected NR modem firmware into Android security patch level updates. Consult the Unisoc Support Announcement and the device vendor's security bulletin for specific build numbers and rollout schedules.
Workarounds
- Restrict device usage to trusted cellular networks when traveling in higher-risk environments.
- Disable 5G NR mode on affected devices where business operations permit, falling back to LTE until a patch is applied.
- Use MDM policies to enforce cellular network whitelists and detect unexpected network registrations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
