CVE-2025-20659

high-risk

Published 2025-04-07

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01519028; Issue ID: MSV-2768.

Do I need to act?

0.28% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

ADJACENT_NETWORK / LOW complexity

Affected Products (20)

Mt2735 Firmware

Mt2737 Firmware

Mt6739 Firmware

Mt6761 Firmware

Mt6762 Firmware

Mt6762D Firmware

Mt6762M Firmware

Mt6763 Firmware

Mt6765 Firmware

Mt6765T Firmware

Mt6767 Firmware

Mt6768 Firmware

Mt6769 Firmware

Mt6769K Firmware

Mt6769S Firmware

Mt6769T Firmware

Mt6769Z Firmware

Mt6771 Firmware

Mt6779 Firmware

Mt6781 Firmware

Affected Vendors

Mediatek

References (1)

Vendor Advisory https://corp.mediatek.com/product-security-bulletin/April-2025

/ 100

high-risk

Severity 21/34 · High

Exploitability 1/34 · Minimal

Exposure 29/34 · Critical