CVE-2025-61607: Google Android DOS Vulnerability

CVE-2025-61607 Overview

CVE-2025-61607 is a high-severity improper input validation vulnerability discovered in the NR modem component of Unisoc chipsets used in Android devices. The vulnerability exists due to insufficient validation of input data processed by the modem, which can result in a system crash when maliciously crafted data is received over the network. This flaw enables remote attackers to trigger a denial of service condition without requiring any user interaction or special privileges.

Critical Impact

Remote attackers can crash affected Android devices running Unisoc chipsets (T8100, T8200, T8300, T9100) by sending specially crafted network packets to the NR modem, causing complete system denial of service with no authentication required.

Affected Products

• Google Android 13.0, 14.0, 15.0, and 16.0
• Unisoc T8100 Chipset
• Unisoc T8200 Chipset
• Unisoc T8300 Chipset
• Unisoc T9100 Chipset

Discovery Timeline

• 2025-12-01 - CVE-2025-61607 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-61607

Vulnerability Analysis

This vulnerability affects the NR (New Radio) modem component in Unisoc chipsets, which handles 5G network communications on Android devices. The CVSS 3.1 score of 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates that the vulnerability can be exploited remotely over the network with low attack complexity. No privileges or user interaction are required to exploit this flaw.

The vulnerability impacts the availability of affected systems but does not affect confidentiality or integrity, making it a pure denial of service vector. The Exploit Prediction Scoring System (EPSS) assigns this vulnerability a probability of 0.153% with a percentile ranking of 36.6, indicating relatively low likelihood of exploitation in the wild at present.

Root Cause

The root cause of CVE-2025-61607 is improper input validation within the NR modem firmware. When the modem receives certain network communications, it fails to properly validate the input parameters before processing them. This lack of validation allows malformed or unexpected data to reach critical code paths that assume well-formed input, leading to undefined behavior and ultimately a system crash.

Modem-level vulnerabilities are particularly concerning because they operate at a low level in the device stack, often with elevated privileges necessary for managing cellular communications. When the modem crashes, it can destabilize the entire device, requiring a reboot to restore functionality.

Attack Vector

The attack vector for this vulnerability is network-based, meaning an attacker can remotely target vulnerable devices without physical access. The attack scenario involves:

1. The attacker identifies a target device using a vulnerable Unisoc chipset (T8100, T8200, T8300, or T9100) running Android 13.0 through 16.0
2. The attacker crafts malicious network packets designed to trigger the improper input validation flaw in the NR modem
3. When the target device processes these packets, the modem fails to properly validate the input, causing a crash
4. The system crash results in denial of service, requiring the device to reboot

Since no authentication is required and the attack can be executed over the network, this vulnerability poses a significant risk to devices exposed to untrusted networks. The attack requires no user interaction, meaning victims would have no warning before their devices crash.

Detection Methods for CVE-2025-61607

Indicators of Compromise

• Unexpected device reboots or system crashes, particularly when connected to cellular networks
• Modem-related crash logs in system diagnostics showing NR modem exceptions
• Repeated system instability in areas where devices connect to potentially compromised or untrusted cellular infrastructure
• Anomalous network traffic patterns targeting modem communication interfaces

Detection Strategies

Organizations managing fleets of Android devices with Unisoc chipsets should implement monitoring for unusual device crash patterns. Mobile device management (MDM) solutions can be configured to alert on devices experiencing frequent reboots or connectivity issues.

Network-level detection may be possible by monitoring for malformed packets targeting modem protocols, though this requires deep packet inspection capabilities at the network edge. SentinelOne's Mobile Threat Defense solution can provide visibility into device health and detect anomalous behavior patterns that may indicate exploitation attempts.

Security teams should review device logs for modem-related exceptions and correlate crash events across the device fleet to identify potential targeted attacks versus random failures.

Monitoring Recommendations

Implement centralized logging for all managed Android devices to capture system crash events and modem errors. Configure alerting thresholds for devices experiencing multiple crashes within short time periods. Consider deploying network monitoring at cellular network egress points where feasible to detect anomalous traffic patterns.

For enterprise deployments, leverage SentinelOne Singularity Mobile to gain visibility into device-level security events and automatically detect behavioral anomalies that may indicate exploitation of this or similar modem vulnerabilities.

How to Mitigate CVE-2025-61607

Immediate Actions Required

• Check device inventory for Android devices using Unisoc T8100, T8200, T8300, or T9100 chipsets running Android 13.0 through 16.0
• Apply the latest firmware updates from Unisoc as documented in their security advisory
• Ensure automatic updates are enabled on all managed Android devices to receive security patches promptly
• Monitor affected devices for signs of exploitation or unusual crash behavior

Patch Information

Unisoc has published a security advisory addressing this vulnerability. Organizations should consult the vendor advisory at https://www.unisoc.com/en/support/announcement/1995394837938163714 for specific patch information and update procedures. Device manufacturers using Unisoc chipsets may need to release their own firmware updates incorporating the Unisoc security fixes.

Android devices should receive patches through their respective manufacturers' update channels. Users should ensure they are running the latest available system software for their specific device model.

Workarounds

While awaiting patches, organizations can implement the following risk reduction measures:

• Limit exposure of affected devices to untrusted networks where possible
• Use enterprise MDM solutions to enforce security policies and monitor device health
• Consider network segmentation to isolate high-value devices from potentially malicious network traffic
• Enable crash reporting and monitoring to quickly identify devices that may be under attack
• For critical operations, consider temporarily using devices with non-affected chipsets until patches are applied

Since this is a network-based vulnerability affecting the modem firmware, software-level workarounds are limited. The most effective mitigation is applying vendor patches as soon as they become available.