CVE-2025-61612: Google Android DOS Vulnerability

CVE-2025-61612 Overview

CVE-2025-61612 is an improper input validation vulnerability affecting the NR modem component in Unisoc chipsets used across multiple Android device versions. The vulnerability exists in the modem's network signaling processing logic, where insufficient validation of incoming data can trigger a system crash. This flaw allows remote attackers to cause a denial of service condition without requiring any user interaction or elevated privileges.

Critical Impact

Remote attackers can crash affected Android devices by sending specially crafted network packets to the NR modem, resulting in system instability and denial of service without requiring authentication or user interaction.

Affected Products

• Google Android 13.0, 14.0, 15.0, 16.0
• Unisoc T7300 Chipset
• Unisoc T8100 Chipset
• Unisoc T8200 Chipset
• Unisoc T8300 Chipset
• Unisoc T9100 Chipset

Discovery Timeline

• March 9, 2026 - CVE-2025-61612 published to NVD
• March 9, 2026 - Last updated in NVD database

Technical Details for CVE-2025-61612

Vulnerability Analysis

This vulnerability stems from inadequate input validation within the NR (New Radio) modem subsystem used in Unisoc mobile chipsets. The NR modem handles 5G network signaling and data processing, making it a critical component in cellular communication. When the modem receives malformed or specially crafted input data through network channels, the lack of proper boundary checks and input sanitization allows the processing logic to enter an invalid state. This results in a system crash, effectively causing a denial of service on the affected device.

The vulnerability is particularly concerning because it can be exploited remotely over the network without requiring any privileges on the target device. The attack does not require user interaction, meaning victims would have no opportunity to prevent the exploit once targeted.

Root Cause

The root cause of CVE-2025-61612 is classified under CWE-20 (Improper Input Validation). The NR modem firmware fails to adequately validate input parameters before processing, allowing malformed data to trigger undefined behavior. This missing validation occurs at the firmware level within the modem's signal processing routines, where incoming network data should be sanitized and validated against expected formats and boundaries before being processed further.

Attack Vector

The attack vector for this vulnerability is network-based, allowing remote exploitation without physical access to the target device. An attacker can craft malicious network packets designed to exploit the input validation weakness in the NR modem. When the affected device's modem processes these packets, the improper validation causes the system to crash.

The attack characteristics include:

• No authentication required to exploit
• No user interaction needed
• Network-accessible attack surface via cellular protocols
• Impact limited to availability (denial of service)

Since no verified code examples are available for this vulnerability, technical exploitation details should be referenced from the Unisoc Support Announcement for authoritative information on the vulnerability mechanism.

Detection Methods for CVE-2025-61612

Indicators of Compromise

• Unexpected device reboots or system crashes, particularly during cellular network activity
• Modem subsystem crash logs indicating NR modem exceptions in system diagnostics
• Repeated baseband processor failures without clear hardware cause
• Abnormal network signaling patterns targeting the NR modem interface

Detection Strategies

• Monitor device crash reports for patterns involving the NR modem or baseband processor components
• Implement network-level anomaly detection to identify malformed cellular signaling traffic
• Deploy mobile threat defense solutions capable of detecting modem-level attacks
• Review system logs for baseband crash events with timestamps correlating to network activity

Monitoring Recommendations

• Enable detailed logging for modem and baseband processor events on managed Android devices
• Configure alerting for repeated system crashes on devices using affected Unisoc chipsets
• Monitor fleet-wide device health metrics to identify coordinated denial of service attempts
• Utilize SentinelOne Mobile Threat Defense to gain visibility into device-level security events and potential exploitation attempts

How to Mitigate CVE-2025-61612

Immediate Actions Required

• Apply the latest security patches from device manufacturers addressing this vulnerability
• Ensure all affected devices are running the most recent firmware version for Unisoc chipsets
• Consider deploying mobile device management (MDM) solutions to enforce update compliance
• Review network security controls for cellular infrastructure to detect potential exploitation attempts

Patch Information

Unisoc has released a security announcement addressing this vulnerability. Affected users and device manufacturers should reference the Unisoc Support Announcement for detailed patch information and firmware updates. Device manufacturers using Unisoc T7300, T8100, T8200, T8300, or T9100 chipsets should incorporate the security fixes into their Android builds for versions 13.0 through 16.0.

Organizations should prioritize deploying updated firmware packages through their device management infrastructure and verify successful deployment across their mobile device fleet.

Workarounds

• No direct user-level workarounds are available since the vulnerability exists in modem firmware
• Organizations can limit exposure by ensuring devices remain on trusted cellular networks where possible
• Implement network monitoring to detect and block suspicious cellular signaling patterns
• Deploy SentinelOne Singularity Mobile to enhance visibility and response capabilities for mobile threats
• Consider temporary isolation of affected devices from critical operations until patches are applied

# Verify Android security patch level on affected devices
adb shell getprop ro.build.version.security_patch

# Check for Unisoc chipset identifier
adb shell getprop ro.hardware

# Review modem firmware version
adb shell getprop gsm.version.baseband