CVE-2025-20708
Published: 01 September 2025
Summary
CVE-2025-20708 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Mediatek Nr15. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 30.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the out-of-bounds write vulnerability by requiring timely application of the vendor-provided patch MOLY01123853 to the MediaTek modem firmware.
Enforces proper bounds checking and validation of inputs received from base stations, directly addressing the incorrect bounds check causing the out-of-bounds write.
Provides memory protection mechanisms such as address space layout randomization and stack canaries to prevent successful exploitation of the out-of-bounds write for privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct out-of-bounds write in modem firmware enables remote privilege escalation on UE via rogue base station with no user interaction or prior privileges.
NVD Description
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no…
more
additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01123853; Issue ID: MSV-4131.
Deeper analysisAI
CVE-2025-20708 is an out-of-bounds write vulnerability (CWE-787) in the Modem component due to an incorrect bounds check. It affects MediaTek modem firmware, as detailed in the vendor's product security bulletin. Published on 2025-09-01, the issue carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is tracked internally as Issue ID MSV-4131.
The vulnerability enables remote escalation of privilege when user equipment (UE), such as a mobile device, connects to a rogue base station controlled by an attacker. Exploitation requires no additional execution privileges or user interaction, allowing an adjacent attacker with low complexity to achieve high confidentiality, integrity, and availability impacts.
MediaTek has addressed the vulnerability with Patch ID MOLY01123853. Security practitioners should consult the September 2025 product security bulletin at https://corp.mediatek.com/product-security-bulletin/September-2025 for mitigation guidance, patch deployment instructions, and affected product lists.
Details
- CWE(s)