CVE-2025-20725
📋 TL;DR
This vulnerability in the IMS service allows remote privilege escalation through an out-of-bounds write when a user equipment (UE) connects to a rogue base station controlled by an attacker. No user interaction or additional privileges are required for exploitation. This affects devices using MediaTek chipsets with vulnerable IMS implementations.
💻 Affected Systems
- MediaTek chipsets with IMS service
📦 What is this software?
Lr12a by Mediatek
Nr15 by Mediatek
Nr16 by Mediatek
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to execute arbitrary code with system privileges, potentially gaining persistent access to the device and network.
Likely Case
Attacker gains elevated privileges on the device, enabling data theft, surveillance, or further exploitation of the device and connected networks.
If Mitigated
Limited impact if devices are patched and network-level protections prevent connection to rogue base stations.
🎯 Exploit Status
Exploitation requires attacker to operate a rogue base station, which adds complexity but no authentication is needed once UE connects.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patch ID: MOLY01671924
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/November-2025
Restart Required: Yes
Instructions:
1. Check with device manufacturer for firmware updates
2. Apply the patch referenced in MediaTek advisory MOLY01671924
3. Reboot device after patch installation
🔧 Temporary Workarounds
Disable automatic network switching
allPrevent devices from automatically connecting to unknown base stations
Use trusted networks only
allConfigure devices to only connect to known, trusted cellular networks
🧯 If You Can't Patch
- Isolate vulnerable devices from critical networks
- Implement network monitoring for rogue base station connections
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against manufacturer's patched versions; devices with unpatched MediaTek IMS service are vulnerable.Check Version:
Device-specific; typically in Settings > About Phone > Software InformationVerify Fix Applied:
Verify patch MOLY01671924 is applied by checking firmware version or patch status in device settings.📡 Detection & Monitoring
Log Indicators:
- Unexpected base station connections
- IMS service crashes or abnormal behavior
- Privilege escalation attempts
Network Indicators:
- Connections to suspicious base station IDs
- Unusual IMS protocol traffic patterns
SIEM Query:
Search for IMS service errors or unexpected network authentication events from mobile devices