The vulnerabilities, disclosed in the company’s May 2025 Product Security Bulletin, impact smartphones, tablets, AIoT devices, smart displays, audio systems, and TV chipsets running various versions of Android and other operating systems. CVE-2025-20670 concerns improper certificate validation (CWE-295) in the Modem component, which could lead to permission bypass and remote information disclosure when connected to a rogue base station. According to the bulletin, “this could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed”. This vulnerability involves a reachable assertion in the Modem component (CWE-617) that could allow remote attackers to trigger a denial of service condition by exploiting an uncaught exception. The vulnerability affects over 30 different chipsets, including popular models like MT6833, MT6877, MT6893, and others running Modem NR15 firmware. This vulnerability affects dozens of chipsets running Modem LR12A, LR13, NR15, NR16, NR17, and NR17R firmware. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Device manufacturers were notified of these issues and provided with corresponding security patches at least two months prior to public disclosure, following MediaTek’s responsible disclosure policy. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 05 May 2025 13:35:09 +0000