CVE-2025-61617 Overview
CVE-2025-61617 is a high-severity vulnerability affecting the NR modem component in Google Android devices running on Unisoc chipsets. The vulnerability stems from improper input validation in the modem firmware, which can be exploited remotely to cause a system crash. This denial of service condition requires no additional execution privileges and can be triggered over the network without user interaction.
The vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network-accessible attack vector with low complexity, no privileges required, and high impact on system availability. According to EPSS data, this vulnerability has a 0.153% probability of exploitation, placing it in the 36.6th percentile.
Critical Impact
Remote attackers can trigger system crashes on affected Android devices with Unisoc modems without authentication, potentially disrupting mobile communications and device availability.
Affected Products
- Google Android 13.0, 14.0, 15.0, and 16.0
- Unisoc T8100 chipset
- Unisoc T8200 chipset
- Unisoc T8300 chipset
- Unisoc T9100 chipset
Discovery Timeline
- 2025-12-01 - CVE-2025-61617 published to NVD
- 2025-12-02 - Last updated in NVD database
Technical Details for CVE-2025-61617
Vulnerability Analysis
The vulnerability resides in the NR (New Radio) modem component, which handles 5G cellular communications on Unisoc-powered Android devices. The modem firmware fails to properly validate input data, allowing malformed or unexpected input to trigger a system crash condition.
The CVSS vector breakdown reveals important characteristics:
- Attack Vector (AV:N): The vulnerability is exploitable over the network
- Attack Complexity (AC:L): Exploitation requires minimal complexity
- Privileges Required (PR:N): No authentication is needed
- User Interaction (UI:N): No user action is required
- Availability Impact (A:H): Complete denial of service is possible
Root Cause
The root cause is improper input validation within the NR modem's data processing routines. When the modem receives specially crafted network data, it fails to validate the input boundaries or data types before processing. This allows an attacker to provide input that triggers undefined behavior, ultimately resulting in a system crash.
The vulnerability is classified as CWE-noinfo by NVD, indicating that while the improper input validation is the underlying issue, specific technical details about the exact validation failure have not been publicly disclosed.
Attack Vector
The attack is network-based and can be executed remotely. An attacker could potentially exploit this vulnerability by sending malformed cellular network packets or signaling messages to a vulnerable device. The attack does not require any special privileges or user interaction, making it particularly dangerous in public wireless environments.
The exploitation mechanism involves crafting malicious input that bypasses the modem's input validation checks. When the modem processes this data, it encounters an error condition that causes the entire system to crash rather than gracefully handling the exception.
Detection Methods for CVE-2025-61617
Indicators of Compromise
- Unexpected device reboots or crashes, particularly during cellular network activity
- Modem firmware crash logs indicating improper data handling
- Network traffic anomalies in cellular signaling data
- System logs showing NR modem component failures
Detection Strategies
Organizations can implement several detection strategies to identify potential exploitation attempts:
- Device Monitoring: Deploy mobile device management (MDM) solutions to track unexpected device reboots and crashes across the fleet
- Log Analysis: Monitor Android system logs for modem-related crash events, particularly those referencing NR modem components
- Network Behavior Analysis: Analyze cellular network traffic patterns for anomalous signaling behavior that could indicate attack attempts
SentinelOne Singularity Mobile provides comprehensive mobile threat detection capabilities that can identify anomalous device behavior associated with modem-level attacks and denial of service conditions.
Monitoring Recommendations
Security teams should implement continuous monitoring of Android devices with Unisoc chipsets:
- Enable crash reporting and centralize device health telemetry
- Configure alerts for repeated unexpected device reboots
- Monitor for firmware integrity issues on affected chipsets
- Track patching compliance for affected Android versions
How to Mitigate CVE-2025-61617
Immediate Actions Required
- Apply the latest security updates from Unisoc and your device manufacturer
- Monitor devices running affected Unisoc chipsets (T8100, T8200, T8300, T9100) for signs of exploitation
- Consider restricting network exposure for critical devices until patches are applied
- Implement mobile device management to enforce security updates
Patch Information
Unisoc has released a security advisory addressing this vulnerability. Organizations should consult the official vendor advisory for patch availability and installation guidance:
- Vendor Advisory: https://www.unisoc.com/en/support/announcement/1995394837938163714
Device manufacturers using Unisoc chipsets should integrate the modem firmware updates into their Android security patch releases. End users should ensure their devices are updated to the latest available firmware version.
Workarounds
If patches cannot be immediately applied, consider the following temporary mitigations:
- Limit exposure of affected devices to untrusted networks where possible
- Enable airplane mode when devices are not actively in use for cellular communications
- Use Wi-Fi connectivity as an alternative where cellular connectivity is not required
- Implement network segmentation to isolate potentially vulnerable mobile devices
Note that these workarounds reduce but do not eliminate the risk, as the vulnerability is inherent to the modem firmware. The definitive solution is to apply the vendor-provided security patches.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
