PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71252 Unisoc CVE debrief

CVE-2025-71252 is a high-severity remote denial-of-service issue in Modem IMS caused by improper input validation. According to NVD, the flaw can be triggered over the network with no additional execution privileges and no user interaction, and the impact is loss of availability rather than code execution or data exposure. NVD references a Unisoc vendor advisory for further product guidance.

Vendor
Unisoc
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-06
Original CVE updated
2026-07-20
Advisory published
2026-05-06
Advisory updated
2026-07-20

Who should care

Security teams responsible for Android devices or products that include Unisoc Modem IMS components should review this issue promptly, especially fleet operators and OEMs that depend on vendor firmware updates. Because the issue is network-reachable and requires no privileges, exposed devices and unmanaged consumer fleets warrant attention.

Technical summary

NVD describes CVE-2025-71252 as an improper input validation problem in Modem IMS. The assigned CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which indicates a remotely reachable issue with low attack complexity, no privileges required, no user interaction, and a high availability impact. NVD also lists a vendor advisory from Unisoc as the reference point for mitigation details.

Defensive priority

High. The combination of remote reachability, no authentication requirement, and high availability impact makes this a priority for patch and exposure review in environments using affected components.

Recommended defensive actions

  • Check whether your devices or firmware images include the affected Modem IMS component referenced by the vendor advisory.
  • Monitor the Unisoc vendor advisory for product-specific remediation guidance and apply vendor-recommended updates as soon as they are available.
  • Prioritize devices that are externally reachable or difficult to update, since the issue can be triggered remotely without privileges.
  • Validate fleet inventory against the affected Android CPE entries listed by NVD and confirm whether your deployment is impacted.
  • After remediation, confirm the updated firmware or system image version across managed devices.

Evidence notes

Source evidence is limited to the official CVE/NVD record and the referenced Unisoc vendor advisory. NVD records the issue as a Modem IMS improper input validation flaw, CVSS 7.5 High, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with vulnStatus set to Analyzed. NVD’s reference list includes the Unisoc advisory URL. The corpus does not provide exploit details, patch version numbers, or vendor remediation steps, so this debrief avoids those unsupported specifics.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-71252 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-71252

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-71252 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71252

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.