CVE-2025-20703
📋 TL;DR
This vulnerability allows remote denial of service attacks against devices with affected MediaTek modems. An attacker can exploit this by setting up a rogue base station that triggers an out-of-bounds read when a vulnerable device connects. All devices using the affected modem firmware are potentially at risk.
💻 Affected Systems
- MediaTek modem chipsets
📦 What is this software?
Nr15 by Mediatek
Nr16 by Mediatek
Nr17 by Mediatek
Nr17r by Mediatek
⚠️ Risk & Real-World Impact
Worst Case
Complete modem failure leading to loss of cellular connectivity, potentially requiring device restart or factory reset to restore functionality.
Likely Case
Temporary denial of cellular service (calls, SMS, mobile data) until the device reconnects to a legitimate base station or reboots.
If Mitigated
Minimal impact with proper network segmentation and base station authentication controls preventing connection to rogue base stations.
🎯 Exploit Status
Exploitation requires setting up a rogue base station with specific malicious configurations to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware patch MOLY01599794
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/September-2025
Restart Required: Yes
Instructions:
1. Contact device manufacturer for firmware updates. 2. Apply MediaTek modem firmware patch MOLY01599794. 3. Reboot device after patch installation.
🔧 Temporary Workarounds
Disable automatic network selection
allManually select trusted network operators to prevent automatic connection to rogue base stations.
Use Wi-Fi calling when available
allReduce reliance on cellular networks in high-risk areas by enabling Wi-Fi calling features.
🧯 If You Can't Patch
- Implement network monitoring for unusual base station connections
- Restrict device usage in high-risk geographic areas where rogue base stations are more likely
🔍 How to Verify
Check if Vulnerable:
Check modem firmware version against MediaTek's affected versions list in their security bulletin.Check Version:
Device-specific commands vary by manufacturer; typically available in Settings > About Phone > Baseband VersionVerify Fix Applied:
Verify modem firmware has been updated to version containing patch MOLY01599794.📡 Detection & Monitoring
Log Indicators:
- Modem crash logs
- Unexpected base station switches
- Cellular connection drops
Network Indicators:
- Devices connecting to unknown base station IDs
- Unusual cellular traffic patterns
SIEM Query:
Search for modem crash events or base station connection anomalies in device logs