CVE-2025-20793 MediaTek, Inc. CVE debrief

Who should care

Defenders responsible for Mediatek-based systems, especially those relying on NR15, NR16, and NR17 components for connectivity, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2025-20793 is a medium-severity vulnerability in Mediatek's Modem component that could lead to remote denial of service. Defenders should prioritize verifying exposure, applying patches, and monitoring for exploitation attempts.

• Potential remote denial of service due to system crash.
• Verification of exposure and patching priority for NR15, NR16, and NR17 components.
• Monitoring for unusual system behavior or crashes indicating exploitation attempts.
• Update incident response plans to handle potential denial of service attacks.

Technical summary

CVE-2025-20793 is a vulnerability in Mediatek's Modem component that could lead to a system crash due to incorrect error handling. This issue can be exploited remotely if a UE has connected to a rogue base station controlled by the attacker, potentially resulting in a denial of service. The affected components are NR15, NR16, and NR17, which are used in various systems for connectivity. Defenders should prioritize verifying exposure of these components, especially in systems relying on them for connectivity, and apply patches or updates provided by Mediatek to address the issue.

Defensive priority

Defenders should prioritize verifying exposure of Mediatek NR15, NR16, and NR17 components, especially in systems relying on these components for connectivity.

Recommended defensive actions

• Verify exposure of Mediatek NR15, NR16, and NR17 components in your environment.
• Apply patches or updates provided by Mediatek to address the incorrect error handling issue.
• Monitor for unusual system behavior or crashes that could indicate exploitation attempts.
• Review and update incident response plans to include procedures for handling potential denial of service attacks.
• Track exceptions and retest remediated assets.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

Evidence from Mediatek and NVD indicates a potential system crash due to incorrect error handling in Modem, which could lead to remote denial of service. The affected components are NR15, NR16, and NR17.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.