CVE-2025-61618: Google Android DOS Vulnerability

CVE-2025-61618 Overview

CVE-2025-61618 is a high-severity vulnerability affecting the NR (New Radio) modem component in Google Android devices utilizing Unisoc chipsets. The vulnerability stems from improper input validation within the modem firmware, which could allow an attacker to trigger a system crash remotely. This denial of service condition requires no additional execution privileges and can be exploited over the network without user interaction.

The vulnerability has a CVSS 3.1 score of 7.5, classified as HIGH severity. The attack complexity is low, making this a relatively straightforward vulnerability to exploit once discovered. With an EPSS score of 0.153% (36.6th percentile), there is a moderate probability of exploitation in the wild.

Critical Impact
Remote attackers can cause complete system denial of service on affected Android devices with Unisoc T-series chipsets without requiring any user interaction or special privileges.

Affected Products

Google Android 13.0, 14.0, 15.0, and 16.0
Unisoc T8100 chipset
Unisoc T8200 chipset
Unisoc T8300 chipset
Unisoc T9100 chipset

Discovery Timeline

2025-12-01 - CVE-2025-61618 published to NVD
2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-61618

Vulnerability Analysis

This vulnerability exists in the NR modem component, which handles 5G New Radio communications in devices equipped with Unisoc T-series chipsets. The improper input validation flaw allows specially crafted network packets or data to bypass expected validation checks, leading to unexpected behavior in the modem firmware.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates that the vulnerability:

Can be exploited remotely over the network (AV:N)
Has low attack complexity (AC:L)
Requires no privileges (PR:N)
Needs no user interaction (UI:N)
Has unchanged scope (S:U)
Does not impact confidentiality or integrity (C:N/I:N)
Has high impact on availability (A:H)

Root Cause

The root cause of CVE-2025-61618 is improper input validation within the NR modem firmware. When the modem receives network data, certain input parameters are not adequately validated before processing. This allows malformed or unexpected input values to reach code paths that are not designed to handle them, resulting in a system crash.

Input validation errors in modem firmware are particularly dangerous because modem components operate at a low level in the system stack and process untrusted network data directly. Without proper bounds checking and input sanitization, attackers can craft malicious inputs that cause the firmware to enter an invalid state.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can exploit this vulnerability by sending specially crafted data to a target device over a cellular network connection. The attack does not require:

Any user interaction on the target device
Prior authentication or privileges
Physical access to the device

The attacker must have the ability to send network traffic to the target device's modem component. Upon receiving the malicious input, the modem fails to properly validate the data, leading to a crash condition that affects the entire system. This could result in complete device unavailability until the system is restarted.

Detection Methods for CVE-2025-61618

Indicators of Compromise

Unexpected device reboots or system crashes without user-initiated actions
Modem-related crash logs in system diagnostics showing NR modem failures
Repeated connectivity issues followed by system instability
Kernel panic events associated with modem driver components

Detection Strategies

Organizations should implement the following detection strategies:

Device Health Monitoring: Deploy mobile device management (MDM) solutions that can monitor device health and detect abnormal crash patterns or repeated system restarts.
Network Traffic Analysis: Monitor cellular network traffic for anomalous patterns that could indicate exploitation attempts against modem firmware.
Log Analysis: Review system logs for modem-related crashes, particularly those occurring without user activity or during periods of network activity.
Endpoint Detection: Utilize endpoint detection and response (EDR) solutions capable of monitoring Android device behavior and identifying DoS attack patterns.

Monitoring Recommendations

Enable comprehensive logging on affected Android devices to capture modem-related events
Configure alerts for repeated system crashes or unexpected reboots
Monitor fleet-wide device health metrics to identify potential mass exploitation attempts
Implement network-level monitoring at cellular gateways where feasible
Maintain an inventory of devices with Unisoc T-series chipsets to prioritize monitoring and patching efforts

How to Mitigate CVE-2025-61618

Immediate Actions Required

Check if your devices use affected Unisoc chipsets (T8100, T8200, T8300, T9100) and Android versions 13.0 through 16.0
Review the official Unisoc security advisory for patch availability
Apply security updates from device manufacturers as soon as they become available
Consider network-level protections where cellular traffic can be inspected
Inventory all affected devices within your organization for prioritized patching

Patch Information

Unisoc has released a security advisory addressing this vulnerability. Organizations and individuals using affected devices should:

Check for available security updates through their device manufacturer's update channels
Review the official Unisoc security advisory at: https://www.unisoc.com/en/support/announcement/1995394837938163714
Contact device manufacturers for firmware update timelines if patches are not yet available
Ensure automatic security updates are enabled on all affected devices

As this vulnerability affects the modem firmware, patches will need to be delivered through device OEM update channels and may require a complete firmware update rather than just an Android security patch.

Workarounds

Due to the nature of this vulnerability affecting low-level modem firmware, complete workarounds are limited. However, organizations can consider the following risk reduction measures:

Prioritize patching for devices that handle sensitive data or are critical to operations
Implement network segmentation where possible to limit exposure
Use mobile threat defense solutions to monitor for exploitation attempts
Maintain device backups to minimize impact from potential DoS attacks
Consider temporary use of alternative devices for critical functions until patches are applied

Organizations should prioritize applying vendor patches as the primary mitigation strategy, as this vulnerability cannot be fully mitigated through configuration changes alone.