CVE-2025-61612: Google Android DOS Vulnerability

CVE-2025-61612 Overview

CVE-2025-61612 is an improper input validation vulnerability [CWE-20] in the 5G New Radio (NR) modem firmware shipped on Unisoc chipsets used in Android devices. A malformed network input can trigger a system crash on the modem, resulting in a remote denial of service. Exploitation requires no authentication, no user interaction, and can be performed over the network. The flaw affects Unisoc T7300, T8100, T8200, T8300, and T9100 platforms running Android 13, 14, 15, and 16.

Critical Impact
An unauthenticated remote attacker within radio range or on a controllable network path can crash the cellular modem, disrupting voice and data connectivity on affected Android devices.

Affected Products

Google Android 13.0, 14.0, 15.0, and 16.0
Unisoc T7300, T8100, T8200, T8300, T9100 chipset platforms
Mobile devices integrating the affected Unisoc 5G NR modem firmware

Discovery Timeline

2026-03-09 - CVE-2025-61612 published to the National Vulnerability Database
2026-03-09 - Last updated in NVD database

Technical Details for CVE-2025-61612

Vulnerability Analysis

The vulnerability resides in the 5G New Radio (NR) modem stack on affected Unisoc baseband processors. The modem firmware fails to properly validate input received over the air interface before processing it. A crafted message triggers an unrecoverable error condition, causing the modem subsystem to crash.

The defect is classified under improper input validation [CWE-20]. The impact is limited to availability — the issue does not expose data or grant code execution privileges. However, a modem crash interrupts cellular service, including emergency calling, until the device or modem restarts.

Devices running Android 13 through 16 are affected when paired with one of the listed Unisoc T-series 5G platforms. Because the trigger sits below the Android operating system, conventional OS-level hardening does not block the attack path.

Root Cause

The modem firmware does not sufficiently sanitize or bounds-check fields in incoming NR signaling messages. When the parser encounters unexpected values, the execution path reaches an unrecoverable fault that halts the modem. The Unisoc security announcement attributes the defect to improper input validation in the NR protocol handling code.

Attack Vector

The attack vector is the cellular air interface. An attacker operating a rogue gNodeB or a compromised network element transmits a malformed NR message to a target device. Proximity-based attacks using software-defined radios and false base stations are the practical delivery method. No pairing, SIM access, or user interaction is required, and the attack succeeds before any application-layer authentication occurs.

No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Unisoc Security Announcement for vendor-specific protocol details.

Detection Methods for CVE-2025-61612

Indicators of Compromise

Unexpected modem restarts or modem subsystem crash logs in Android dmesg and logcat output on affected Unisoc devices
Repeated cellular service drops correlated with proximity to unknown base stations or unfamiliar Public Land Mobile Network (PLMN) identifiers
Mobile device management (MDM) telemetry showing clusters of modem reset events across a fleet in the same physical location

Detection Strategies

Collect Android bug reports and modem crash dumps from managed devices and parse them for repeated nr or 5gnr modem fault signatures
Monitor enterprise MDM and Unified Endpoint Management (UEM) logs for abnormal rates of RIL reinitialization or radio state transitions
Correlate device-reported cell tower identifiers with known carrier infrastructure to flag interactions with rogue gNodeBs

Monitoring Recommendations

Forward mobile device modem and connectivity telemetry to a central log platform for fleet-wide trend analysis
Establish baselines for normal modem reset frequency and alert on statistically significant deviations
Track patch level (ro.build.version.security_patch) compliance across affected Unisoc-based device inventories

How to Mitigate CVE-2025-61612

Immediate Actions Required

Inventory mobile devices using Unisoc T7300, T8100, T8200, T8300, and T9100 chipsets and confirm their current Android security patch level
Apply vendor firmware updates as soon as device manufacturers release them through their over-the-air (OTA) update channels
Restrict use of affected devices in environments where cellular availability is safety-critical until patches are deployed

Patch Information

Unisoc has acknowledged the vulnerability in its security announcement and is distributing fixes to downstream original equipment manufacturers (OEMs). Device users must obtain the corresponding OTA update from their device manufacturer. Review the Unisoc Security Announcement for the authoritative remediation reference.

Workarounds

Disable 5G NR connectivity on affected devices and restrict the radio to LTE where the option is exposed in network settings
Enable airplane mode in untrusted radio environments to prevent attachment to rogue base stations
Use enterprise policies to require trusted PLMNs and restrict roaming on managed devices until firmware updates are installed

bash

# Verify Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch

# Capture modem crash artifacts for analysis
adb bugreport modem_crash_$(date +%Y%m%d).zip