CVE-2025-20760
📋 TL;DR
This vulnerability in MediaTek modems allows reading uninitialized heap data when a device connects to a malicious base station. It can cause remote denial of service without user interaction or special privileges. Affects devices using vulnerable MediaTek modem firmware.
💻 Affected Systems
- MediaTek modem chipsets
📦 What is this software?
Nr15 by Mediatek
Nr16 by Mediatek
Nr17 by Mediatek
⚠️ Risk & Real-World Impact
Worst Case
Permanent device bricking or persistent denial of service requiring hardware replacement
Likely Case
Temporary service disruption requiring device reboot
If Mitigated
Service interruption limited to cellular connectivity only
🎯 Exploit Status
Requires attacker to deploy rogue base station in target area
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware with patch ID MOLY01676750
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/January-2026
Restart Required: Yes
Instructions:
1. Contact device manufacturer for firmware update 2. Apply modem firmware update 3. Reboot device
🔧 Temporary Workarounds
Disable cellular when not needed
androidTurn off cellular radio in high-risk areas
adb shell svc data disable
Settings > Network > Mobile data OFF
Use trusted networks only
allConfigure device to connect only to known carrier networks
🧯 If You Can't Patch
- Deploy in Faraday cage or shielded environments for critical devices
- Use devices with different modem chipsets for high-security applications
🔍 How to Verify
Check if Vulnerable:
Check modem firmware version against vendor advisoryCheck Version:
adb shell getprop | grep gsm.version.basebandVerify Fix Applied:
Verify patch ID MOLY01676750 is present in modem firmware📡 Detection & Monitoring
Log Indicators:
- Modem crash logs
- Unexpected base station connections
- Radio interface layer errors
Network Indicators:
- Connections to unknown base station IDs
- Unusual cell tower handoffs
SIEM Query:
source="modem_logs" AND (event="crash" OR event="exception")