CVE-2025-61619 Overview
CVE-2025-61619 is an improper input validation vulnerability in the 5G New Radio (NR) modem firmware used in Unisoc chipsets deployed across Android devices. A remote attacker can trigger a system crash by sending crafted modem input, resulting in a denial of service condition. No user interaction or authentication is required to exploit this vulnerability.
The flaw affects Unisoc T8100, T8200, T8300, and T9100 platforms running Android versions 13 through 16. The issue resides in baseband processing logic that fails to validate input before consumption.
Critical Impact
Remote, unauthenticated attackers can crash the modem subsystem and disrupt cellular connectivity on affected Android devices without any user interaction.
Affected Products
- Google Android 13.0, 14.0, 15.0, and 16.0
- Unisoc T8100 and T8200 chipsets
- Unisoc T8300 and T9100 chipsets
Discovery Timeline
- 2025-12-01 - CVE-2025-61619 published to NVD
- 2025-12-02 - Last updated in NVD database
Technical Details for CVE-2025-61619
Vulnerability Analysis
The vulnerability resides in the NR modem firmware shipped on Unisoc 5G platforms used by Android handset manufacturers. The modem fails to validate specific fields in incoming radio protocol input, leading to an unhandled condition that crashes the modem subsystem. Because the modem operates as an independent processor, a crash disrupts cellular voice and data services on the device.
NVD classifies the weakness as [NVD-CWE-noinfo] because Unisoc has not disclosed the underlying weakness category. The advisory describes the issue as improper input validation that produces a remote denial of service with no additional execution privileges needed.
Root Cause
The root cause is missing or insufficient validation of attacker-controllable fields parsed by the NR modem stack. When malformed data reaches the affected parsing routine, the modem enters an invalid state that terminates execution rather than safely rejecting the input.
Attack Vector
An attacker reaches the vulnerable code over the air interface by transmitting crafted 5G NR signaling toward a target device. Exploitation typically requires proximity to the victim or a rogue base station capable of injecting NR protocol messages. The attack requires no credentials, no user interaction, and no prior compromise of the device.
No public proof-of-concept exploit is available for CVE-2025-61619, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Unisoc Support Announcement for vendor details.
Detection Methods for CVE-2025-61619
Indicators of Compromise
- Repeated, unexplained modem resets or loss of cellular signal across devices in a specific physical area
- Android system logs showing baseband or rild (radio interface layer daemon) crash events without a corresponding user action
- Sudden clusters of mobile device disconnections correlating with the presence of unknown radio transmitters
Detection Strategies
- Monitor mobile device management (MDM) telemetry for abnormal modem restart counters on Unisoc-based Android fleets
- Correlate baseband crash reports with geolocation data to identify potential rogue base station activity
- Review Android dropbox and tombstone artifacts for recurring crashes originating in modem services
Monitoring Recommendations
- Track Android Security Bulletin advisories and Unisoc support announcements for downstream patch availability
- Configure MDM solutions to alert when devices report repeated radio subsystem failures
- Maintain an inventory of Unisoc T8100, T8200, T8300, and T9100 devices to prioritize patch deployment
How to Mitigate CVE-2025-61619
Immediate Actions Required
- Identify Android devices using Unisoc T8100, T8200, T8300, or T9100 chipsets within the environment
- Apply the latest Android security update from the device manufacturer once it incorporates the Unisoc fix
- Restrict use of affected devices in untrusted radio environments until patches are installed
Patch Information
Unisoc has acknowledged the issue in its support announcement and is distributing fixes through device manufacturers. Refer to the Unisoc Support Announcement and the device vendor's security bulletin for firmware availability. Confirm that the Android security patch level on each device reflects the bulletin that includes CVE-2025-61619.
Workarounds
- Disable 5G NR connectivity on affected devices and restrict them to LTE where operationally feasible
- Avoid attaching affected devices to unknown or unverified cellular networks
- Enroll devices in an MDM platform that can enforce baseline configuration and report crash telemetry
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
