CVE-2025-61610: Google Android DOS Vulnerability

CVE-2025-61610 Overview

CVE-2025-61610 is an improper input validation vulnerability in the 5G New Radio (NR) modem firmware used in Unisoc chipsets deployed in Google Android devices. An attacker can send crafted network input to trigger a system crash, resulting in remote denial of service. No user interaction or privileges are required to exploit this flaw.

The vulnerability affects multiple Unisoc T-series chipsets running Android 13 through 16. Unisoc published a security announcement acknowledging the issue and providing remediation guidance to device manufacturers.

Critical Impact
Remote attackers can crash the modem subsystem without authentication, disrupting cellular connectivity on affected Android devices.

Affected Products

Google Android 13.0, 14.0, 15.0, and 16.0
Unisoc T8100 and T8200 chipsets
Unisoc T8300 and T9100 chipsets

Discovery Timeline

2025-12-01 - CVE-2025-61610 published to the National Vulnerability Database
2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-61610

Vulnerability Analysis

The flaw resides in the NR modem component responsible for processing 5G radio protocol messages. The modem firmware does not adequately validate incoming input fields before processing them. Malformed or unexpected values reach internal handling logic, triggering an unrecoverable error condition and causing the modem subsystem to crash.

Because the modem operates as a privileged baseband processor handling all cellular traffic, a crash disrupts voice, SMS, and data services on the affected device. The attack does not require authentication or user interaction and is delivered over the cellular network interface.

Root Cause

The root cause is improper input validation in the NR modem firmware. The component fails to enforce boundary, type, or structural checks on data received from the radio interface. The associated weakness is classified under [NVD-CWE-noinfo] because Unisoc has not published detailed weakness categorization.

Attack Vector

An attacker within range of the targeted device, or one operating a rogue base station, can transmit crafted 5G NR signaling messages to the victim modem. Processing these messages causes the firmware to terminate abnormally. The result is a denial of service affecting cellular functionality until the modem is reinitialized.

No public proof-of-concept or exploit code is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified code examples are available. Refer to the Unisoc Security Announcement for vendor-supplied technical details.

Detection Methods for CVE-2025-61610

Indicators of Compromise

Unexpected modem restarts or repeated cellular service drops on affected Unisoc-powered Android devices.
System logs reporting modem subsystem crashes, baseband resets, or radio interface re-registration events.
Sudden loss of voice, SMS, and mobile data without corresponding network outages.

Detection Strategies

Aggregate Android logcat and dmesg output from managed devices to identify recurring modem crash signatures.
Correlate modem reset events with device location to detect potential rogue base station activity.
Monitor mobile device management (MDM) telemetry for anomalous radio state transitions across the fleet.

Monitoring Recommendations

Track Android security patch level on enrolled devices and flag devices missing vendor updates that address Unisoc advisories.
Alert on clusters of modem failures originating from the same geographic area, which may indicate active exploitation.
Review carrier-side signaling logs where available for malformed NR messages targeting affected chipsets.

How to Mitigate CVE-2025-61610

Immediate Actions Required

Inventory devices using Unisoc T8100, T8200, T8300, and T9100 chipsets across Android 13 through 16.
Apply the Android security patch supplied by the device manufacturer that incorporates the Unisoc fix.
Restrict use of high-risk affected devices in environments where cellular availability is operationally critical until patched.

Patch Information

Unisoc has released a fix for the NR modem input validation flaw. Device OEMs must integrate the corrected modem firmware into their Android security updates. Refer to the Unisoc Security Announcement for the official vendor advisory and patch availability.

Workarounds

Disable 5G NR connectivity on affected devices and force 4G LTE fallback where the device settings permit.
Enable airplane mode in untrusted radio environments such as conferences or large public venues until firmware updates are deployed.
Replace end-of-life devices that will not receive vendor updates with hardware running supported, patched firmware.

bash

# Verify Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch

# Inspect modem firmware version for affected Unisoc chipsets
adb shell getprop gsm.version.baseband