MediaTek September 2025 Security Bulletin: High-Severity Modem Flaws Could Enable Remote Attacks

MediaTek has published its September 2025 Product Security Bulletin, which details several high- and medium-severity vulnerabilities affecting a wide range of its chipsets. The bulletin states there is “no evidence that these vulnerabilities have been exploited in the wild” and warns that flaws in the modem components could allow remote escalation of privilege or denial-of-service, with rogue base stations acting as a frequent attack vector.

Three high-severity flaws stand out in the modem component: CVE-2025-20708, CVE-2025-20703, and CVE-2025-20704, with the first two enabling remote privilege escalation or remote denial of service and the third requiring user interaction for exploitation, according to MediaTek.

Affected devices span MT27xx, MT67xx, MT68xx, MT69xx and MT87xx families, covering smartphones, tablets and IoT devices, and software versions include Modem NR15–NR17R and Android builds from 13.0 through 16.0, as well as openWRT and Yocto distributions. MediaTek says device OEMs have been notified in advance and that security patches are being distributed to vendors, with end users urged to apply the latest firmware or OS updates.