Cyber Resilience

CVE-2025-20659

Medium

Published: 07 April 2025

Published
07 April 2025
Modified
17 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0031 54.8th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-20659 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Mediatek Mt2735 Firmware. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 45.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges…

more

needed. User interaction is not needed for exploitation. Patch ID: MOLY01519028; Issue ID: MSV-2768.

CWE(s)
CWE-125

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

mediatek
mt2735 firmware
all versions
mediatek
mt2737 firmware
all versions
mediatek
mt6739 firmware
all versions
mediatek
mt6761 firmware
all versions
mediatek
mt6762 firmware
all versions
mediatek
mt6762d firmware
all versions
mediatek
mt6762m firmware
all versions
mediatek
mt6763 firmware
all versions
mediatek
mt6765 firmware
all versions
mediatek
mt6765t firmware
all versions
+75 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References