Listen to this Post
This vulnerability exists within the modem firmware stack of MediaTek chipsets. It is caused by improper validation of specific input parameters from network signaling messages. When a User Equipment (UE), such as a smartphone, connects to a malicious actor’s rogue radio base station, the station can transmit specially crafted radio resource control (RRC) packets. These malformed packets contain unexpected or out-of-range values in critical information elements. The modem’s software fails to properly sanitize these inputs before processing, leading to an access violation or buffer handling error. This triggers a fatal exception within the modem application processor (AP), causing a complete crash and reboot of the modem subsystem. The attack requires no user interaction and no elevated privileges, exploiting the normal network attachment procedure. Successful exploitation results in a persistent denial of service, rendering the device incapable of making/receiving calls or using mobile data until the modem reboots.
Platform: MediaTek Modem
Version: MOLY00628396
Vulnerability: Remote DoS
Severity: Critical
date: 12/01/2025
Prediction: Patch available
What Undercode Say:
$ strings modem.img | grep -i “rrc”
$ adb logcat -b radio | grep -A 5 -B 5 “CRASH”
Analyst note: Look for repeated modem subsystem restarts (ssmr) in kernel logs.
How Exploit:
1. Attacker operates rogue base station (e.g., OpenAirInterface).
- UE scans and attaches to this malicious tower.
3. Rogue station injects malformed RRC signaling packet.
4. Target modem processes invalid packet, crashes.
Protection from this CVE
Apply patch MOLY00628396 from OEM. Disable automatic network selection; use manual, trusted operators only. Monitor for modem firmware updates.
Impact:
Persistent network denial, requiring full device reboot. Potential baseband instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
