Overview CVE-2025-20757 describes a remote denial of service vulnerability affecting MediaTek modems. The vulnerability stems from improper input validation within the modem’s software. An attacker leveraging a rogue base station can exploit this weakness to trigger a system crash, leading to a denial of service condition on the affected device. This vulnerability requires no user interaction and can be exploited remotely without requiring any additional execution privileges. The patch ID for this issue is MOLY01673751, and the internal issue ID is MSV-4644. Published: 2025-12-02T03:16:17.050 Technical Details The root cause of CVE-2025-20757 lies in insufficient input validation within the modem’s processing…

This article provides an in-depth analysis of CVE-2025-20756, a significant vulnerability affecting modems that can lead to a remote denial-of-service (DoS) condition. We will delve into the technical details of the vulnerability, its potential impact, and the necessary steps to mitigate the risk. Overview CVE-2025-20756 describes a logic error present in certain modem implementations. This flaw allows a malicious actor, by controlling a rogue base station, to trigger a system crash on vulnerable devices connected to it. The exploitation requires no user interaction and doesn’t need any special privileges on the target device. Technical Details The vulnerability stems from a…

Overview CVE-2025-20755 describes a critical vulnerability affecting MediaTek modems. This vulnerability stems from improper input validation within the modem software, potentially leading to an application crash and a remote denial of service (DoS) condition. An attacker exploiting this flaw requires no user interaction and does not need elevated privileges on the device, making it particularly dangerous. Successful exploitation relies on the UE connecting to a rogue base station controlled by the attacker. Technical Details The root cause of CVE-2025-20755 is insufficient input validation within the modem software. When a User Equipment (UE) connects to a base station, data is exchanged,…

Overview CVE-2025-20754 is a vulnerability affecting MediaTek modem components that could lead to a remote denial-of-service (DoS) condition. This flaw is due to an incorrect bounds check within the modem software. An attacker exploiting this vulnerability does not require user interaction or elevated privileges, making it a highly concerning issue for potentially affected devices. Technical Details The vulnerability stems from an improper bounds check within the MediaTek modem software. If a User Equipment (UE), such as a mobile phone, connects to a rogue base station controlled by an attacker, the attacker can send specially crafted data that triggers the incorrect…

Overview CVE-2025-20753 is a newly discovered vulnerability affecting MediaTek modems. This vulnerability could allow a remote attacker to cause a system crash, leading to a denial of service (DoS) condition. The vulnerability stems from an uncaught exception within the modem’s firmware. Technical Details The root cause of CVE-2025-20753 lies in the modem’s handling of specific network packets. An attacker controlling a rogue base station can exploit this by sending specially crafted packets to a vulnerable device. The modem’s firmware fails to properly handle an exception triggered by these packets, resulting in a system crash. The vulnerability is identified by Issue…

Overview CVE-2025-20752 is a critical vulnerability affecting modems, potentially leading to a remote denial-of-service (DoS) condition. This vulnerability stems from a missing bounds check within the modem’s software, making it susceptible to exploitation by a malicious actor controlling a rogue base station. A successful exploit requires no user interaction and doesn’t need elevated privileges, making it particularly dangerous. The vulnerability is identified with Patch ID MOLY01270690 and Issue ID MSV-4301. Technical Details The core of the vulnerability lies in a missing bounds check within the modem software. This missing check allows a specially crafted message originating from a rogue base…

Overview CVE-2025-20751 is a security vulnerability affecting MediaTek modems. This vulnerability, stemming from a missing bounds check, could allow a remote attacker to trigger a system crash, leading to a denial-of-service (DoS) condition. The vulnerability can be exploited if a User Equipment (UE) connects to a rogue base station controlled by a malicious actor. Technical Details The core issue lies in the modem’s handling of incoming data without proper validation of the data’s boundaries. Specifically, a missing bounds check allows an attacker controlling a rogue base station to send crafted data that exceeds the expected buffer limits. This overflow leads…

Overview CVE-2025-20750 describes a critical vulnerability affecting certain MediaTek modem components. This vulnerability allows a remote attacker to cause a system crash, resulting in a denial-of-service (DoS) condition. The vulnerability stems from improper input validation within the modem software. Technical Details The vulnerability, identified as Issue ID MSV-4296, is located within the modem component. Specifically, it arises from a failure to properly validate input data received by the modem. An attacker could potentially exploit this by setting up a rogue base station. When a vulnerable device connects to this malicious base station, the attacker can send specially crafted data that…

Overview A critical security vulnerability, identified as CVE-2025-13697, has been discovered in the BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress. This vulnerability is a Stored Cross-Site Scripting (XSS) flaw that could allow attackers to inject malicious scripts into your WordPress website, potentially compromising user data and site integrity. All versions up to, and including, 2.2.13 are affected. Immediate action is recommended to mitigate this risk. Technical Details The vulnerability exists due to insufficient input sanitization and output escaping of the ‘timestamp’ attribute within the BlockArt Blocks plugin. Specifically, an…

Overview A high-severity vulnerability, identified as CVE-2025-12529, has been discovered in the Cost Calculator Builder plugin for WordPress. This vulnerability allows unauthenticated attackers to delete arbitrary files on the server. Exploitation of this vulnerability can lead to remote code execution, potentially compromising the entire WordPress site. This issue affects all versions up to, and including, 3.6.3 of the plugin, but is only exploitable when the Pro version of the Cost Calculator Builder plugin is also installed along with the free version. Technical Details The vulnerability stems from insufficient file path validation within the deleteOrdersFiles() function of the Cost Calculator Builder…