CVE-2025-61609: Google Android Modem DOS Vulnerability

CVE-2025-61609 Overview

CVE-2025-61609 is a high-severity vulnerability affecting the modem component in Google Android devices utilizing Unisoc chipsets. The vulnerability stems from improper input validation in the modem firmware, which can be exploited to cause a system crash. This remote denial of service vulnerability requires no additional execution privileges and can be triggered over the network without user interaction.

The vulnerability has a CVSS v3.1 score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network-based attack capability with low complexity and no authentication requirements. According to EPSS data, there is a 0.153% probability of exploitation in the wild, placing it in the 36.6th percentile of exploitability.

Critical Impact
Remote attackers can trigger a denial of service condition on affected Android devices with Unisoc modems, causing system crashes without requiring any privileges or user interaction.

Affected Products

Google Android 13.0, 14.0, 15.0, and 16.0
Unisoc T8100 chipset
Unisoc T8200 chipset
Unisoc T8300 chipset
Unisoc T9100 chipset

Discovery Timeline

2025-12-01 - CVE-2025-61609 published to NVD
2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-61609

Vulnerability Analysis

This improper input validation vulnerability exists within the modem component of Unisoc chipsets running on Android devices. The modem firmware fails to properly validate input data received through network communications, allowing malformed or unexpected input to trigger a system crash. The vulnerability affects the baseband processor functionality, which handles cellular network communications.

The CVSS vector indicates that this vulnerability can be exploited remotely over the network (AV:N) with low attack complexity (AC:L). No privileges (PR:N) or user interaction (UI:N) are required for successful exploitation. While the vulnerability does not impact confidentiality (C:N) or integrity (I:N), it has a high impact on availability (A:H), allowing attackers to disrupt device operation.

Root Cause

The root cause of CVE-2025-61609 is improper input validation within the Unisoc modem firmware. When processing network-received data, the modem component fails to adequately verify input boundaries, data types, or expected values before processing. This lack of validation allows specially crafted network packets or signaling messages to reach vulnerable code paths that assume well-formed input, ultimately leading to a crash condition.

Input validation failures in modem firmware are particularly dangerous because the modem operates at a low level in the device's communication stack and handles sensitive cellular protocol operations. Any crash in this component can render the device unable to communicate over cellular networks and may require a full device restart to recover.

Attack Vector

The attack vector for CVE-2025-61609 is network-based, meaning an attacker can remotely exploit the vulnerability without physical access to the target device. Potential attack scenarios include:

Malicious Base Station Attack: An attacker operating a rogue cellular base station could send specially crafted signaling messages to vulnerable devices within range, triggering the modem crash.
Network-Level Exploitation: If the attacker has the ability to inject or modify network traffic, they could send malformed packets designed to exploit the input validation flaw.
Over-the-Air Attack: The vulnerability could potentially be triggered through standard cellular network communications if the attacker can control or influence the data being transmitted to the device's modem.

The low complexity and no-authentication requirements make this vulnerability particularly concerning for devices in the field, as exploitation does not require sophisticated attack infrastructure.

Detection Methods for CVE-2025-61609

Indicators of Compromise

Unexpected device reboots or crashes, particularly during cellular network activity
Modem component crashes appearing in system logs
Repeated baseband processor failures
Loss of cellular connectivity followed by system instability

Detection Strategies

Organizations can implement the following detection strategies to identify potential exploitation attempts:

Log Monitoring: Monitor Android system logs for modem-related crashes or abnormal behavior. Look for entries indicating baseband processor failures, modem restarts, or cellular stack errors that occur without apparent cause.

Behavioral Analysis: Implement device health monitoring that tracks unexpected system crashes, particularly those correlated with cellular network activity. Multiple devices experiencing simultaneous modem-related issues may indicate an active attack.

Network Traffic Analysis: For managed devices, consider implementing network-level monitoring to detect unusual cellular signaling patterns or malformed protocol messages that could indicate exploitation attempts.

Monitoring Recommendations

Security teams should implement continuous monitoring for devices running affected Unisoc chipsets and Android versions. Key monitoring activities include:

Establish baseline device stability metrics and alert on anomalous crash rates
Configure centralized logging for mobile device management (MDM) platforms to capture modem-related events
Monitor for patterns of denial of service affecting multiple devices in proximity
Track firmware and security patch levels across the device fleet to identify vulnerable endpoints

How to Mitigate CVE-2025-61609

Immediate Actions Required

Review the Unisoc security advisory at https://www.unisoc.com/en/support/announcement/1995394837938163714 for specific patch information
Apply the latest Android security updates for affected device versions (Android 13.0, 14.0, 15.0, 16.0)
Prioritize patching for devices with Unisoc T8100, T8200, T8300, and T9100 chipsets
Consider network-level protections for high-value devices until patches can be applied

Patch Information

Unisoc has released a security advisory addressing this vulnerability. Organizations should consult the vendor advisory for specific patch availability and installation instructions for affected chipsets. The advisory is available at:

Vendor Advisory: https://www.unisoc.com/en/support/announcement/1995394837938163714

Android security updates should be obtained through standard device update mechanisms or from device manufacturers who incorporate Unisoc chipsets into their products.

Workarounds

Due to the nature of this modem-level vulnerability, complete workarounds without applying vendor patches are limited. However, organizations can implement the following risk reduction measures:

Limit exposure of vulnerable devices to untrusted cellular networks where possible
For critical applications, consider using devices with alternative chipsets until patches are deployed
Implement device management policies that enforce automatic security updates
Configure monitoring and alerting for device instability that may indicate exploitation attempts