CVE-2025-20794 MediaTek, Inc. CVE debrief

Who should care

Defenders and security teams responsible for Mediatek-based systems, particularly those using affected Modem versions, should assess exposure and apply remediation. This includes teams managing UE connections, network infrastructure, and security operations. The vulnerability's impact on operational continuity and potential for denial of service necessitates attention from these groups. They should verify affected versions, apply vendor remediation, and be

Why it matters

CVE-2025-20794 is a medium-severity vulnerability in Mediatek's Modem that could lead to remote denial of service. Defenders should assess exposure, verify affected versions, and apply vendor remediation.

• Denial of service via system crash
• Potential disruption of UE connections
• Need for verification of affected versions
• Priority for applying vendor remediation

Technical summary

Improper input validation in Mediatek's Modem could lead to a system crash and remote denial of service. This requires no additional execution privileges and no user interaction for exploitation. The vulnerability is addressed in Mediatek's January 2026 security bulletin. Affected Mediatek Modem versions are vulnerable to exploitation via rogue base stations. Defenders should focus on verifying affected versions and applying remediation as specified by the vendor. The vulnerability has a medium severity score, indicating a need for prompt attention but not immediate panic.

Defensive priority

Medium priority for inventory checks and verification of affected versions, with high priority for applying vendor remediation.

Recommended defensive actions

• Inventory and verify affected Mediatek Modem versions
• Apply vendor remediation from Mediatek's January 2026 security bulletin
• Monitor for rogue base station activity
• Implement compensating controls for UE connections
• Review and update incident response plans for potential denial of service scenarios
• Conduct vulnerability scanning to identify exposed systems
• Track and verify remediation progress for affected assets

Evidence notes

The CVE record and NVD detail page provide official information on the vulnerability. Mediatek's security bulletin for January 2026 is referenced as a source reference. The bulletin provides details on the affected versions and remediation steps. Defenders should verify affected Mediatek Modem versions and apply vendor remediation. The CVE record was published on 2026-01-06T02:15:43.297Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.