Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-20634: Mediatek NR16/NR17 devices can be hijacked by fake tower

CVE-2025-20634 · published 1 year ago

Summary

The Mediatek NR16, NR17 and NR17R cellular modems may write data outside of allowed memory when connecting to a malicious base station. This flaw lets an attacker run code on the device without any user interaction. Apply the vendor’s security update as soon as possible to protect your equipment.

What to do

Update google :unknown: to version SoCVersion:2025-02-05.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	mediatek	nr16	All versions `cpe:2.3:o:mediatek:nr16:-:::::::*`
–	mediatek	nr17	All versions `cpe:2.3:o:mediatek:nr17:-:::::::*`
–	mediatek	nr17r	All versions `cpe:2.3:o:mediatek:nr17r:-:::::::*`
Android	google	:unknown:	>= SoCVersion:0, < SoCVersion:2025-02-05 Fix: upgrade to SoCVersion:2025-02-05

Original advisory text

ASB-A-381773169

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01289384; Issue ID: MSV-2436.

References

https://source.android.com/security/bulletin/2025-02-01 Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/February-2025 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published1 Feb 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2025-20634 · NVD

ASB-A-381773169 · OSV

Track software like this

Free during beta