CVE-2025-61617: Google Android DoS Vulnerability

CVE-2025-61617 Overview

CVE-2025-61617 is a remote denial of service vulnerability in the Unisoc 5G New Radio (NR) modem firmware. The flaw stems from improper input validation in the NR modem component used by multiple Unisoc chipsets that ship in Android devices. An attacker can send crafted network input to trigger a system crash without any user interaction or authentication. Exploitation requires no additional execution privileges and impacts device availability. The vulnerability affects Android 13, 14, 15, and 16 builds running on Unisoc T8100, T8200, T8300, and T9100 platforms.

Critical Impact
Remote attackers can crash the cellular modem subsystem on affected Unisoc-based Android devices, disrupting voice and data connectivity without authentication or user interaction.

Affected Products

Google Android 13.0, 14.0, 15.0, and 16.0
Unisoc T8100 and T8200 chipsets
Unisoc T8300 and T9100 chipsets

Discovery Timeline

2025-12-01 - CVE-2025-61617 published to NVD
2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-61617

Vulnerability Analysis

The vulnerability resides in the NR modem baseband firmware used by Unisoc T-series chipsets. The modem fails to properly validate input received over the cellular radio interface. When the modem processes a malformed signaling message or protocol field, the resulting state leads to an unrecoverable crash of the modem subsystem. NVD classifies the weakness as [NVD-CWE-noinfo], with vendor advisories withholding the specific protocol layer involved. The impact is limited to availability — confidentiality and integrity are not affected. Because the modem handles cellular signaling autonomously, exploitation does not depend on any user action or installed application. Recovery typically requires a modem reset or device reboot to restore connectivity.

Root Cause

The root cause is improper input validation [CWE-20] within the NR modem firmware. The component accepts attacker-controlled protocol input without sufficient bounds or type checks before processing. The Unisoc advisory does not disclose the specific 5G NR procedure or message type involved.

Attack Vector

The attack vector is network-based and exercised over the cellular radio link. An attacker operating a rogue base station or a base station simulator within radio range can transmit malformed NR signaling messages to a target device. No pairing, authentication, or user interaction is required. Successful delivery of the malformed input triggers a modem crash and a denial of service condition on the affected handset.

No public proof-of-concept code is available. See the Unisoc Security Announcement for vendor-published details.

Detection Methods for CVE-2025-61617

Indicators of Compromise

Repeated modem subsystem crashes or ramdump events logged by the Android platform with Unisoc-specific crash signatures.
Sudden loss of cellular service on affected Unisoc-based devices followed by automatic modem restart events.
Unexpected reboots correlated with proximity to unknown or unauthorized cellular base stations.

Detection Strategies

Monitor mobile device management (MDM) telemetry for elevated rates of modem reset events on fleets containing Unisoc T8100, T8200, T8300, or T9100 devices.
Correlate device crash logs with location data to identify clusters of failures that may indicate a rogue base station targeting an area.
Review Android system logs (logcat, dmesg) for modem firmware crash traces and panic signatures on affected chipsets.

Monitoring Recommendations

Enforce reporting of crash and reboot telemetry from managed mobile endpoints into a centralized log platform for trend analysis.
Track patch level (ro.build.version.security_patch) across the device fleet to identify endpoints still running vulnerable Unisoc firmware.
Establish baselines for cellular connectivity stability and alert on statistically significant deviations affecting Unisoc-equipped devices.

How to Mitigate CVE-2025-61617

Immediate Actions Required

Inventory mobile devices that use Unisoc T8100, T8200, T8300, or T9100 chipsets across the organization.
Apply the Android security patch level that incorporates the Unisoc fix for CVE-2025-61617 as soon as it is available from the device OEM.
Prioritize patching for high-risk users such as executives, field personnel, and travelers operating in untrusted radio environments.

Patch Information

Unisoc has published a security announcement acknowledging the vulnerability. Refer to the Unisoc Security Announcement for vendor guidance. Patches are distributed through downstream OEM firmware updates and Android security bulletins. Verify the device security patch level after update to confirm the fix is applied.

Workarounds

Restrict use of affected devices in environments where rogue base station activity is plausible until firmware updates are deployed.
Disable 5G NR connectivity through carrier or device settings where feasible, forcing fallback to LTE on impacted handsets.
Use carrier-provided protections against fake base stations and enable any available cell network security indicators on supported Android builds.

bash

# Check Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.product.board
adb shell getprop ro.hardware