UNISOC Modem CVE-2025-31718

Exploitation requires the attacker to deliver a crafted, improperly-validated input (signaling/protocol message) to the UNISOC modem over its network/radio interface; the CVSS AV:N for a baseband component generally implies the attacker must be able to reach the modem's air/radio interface (e.g. radio proximity or a rogue/controlling network element) rather than arbitrary internet routing. No authentication is required (PR:N) and no user interaction is needed (UI:N), and it works against affected modems without special execution privileges. The description does not name the specific protocol, feature, or configuration triggering the flaw, so the precise message type is unconfirmed; the main limiting factor is the attacker's need for network/radio position to reach the modem, and the impact is confined to availability (device/modem crash) rather than data compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes a network-reachable, low-complexity, unauthenticated flaw whose ONLY impact is availability (A:H) - a modem/baseband system crash. This directly contradicts the textual description, which claims 'remote escalation of privilege'; the vector shows no confidentiality or integrity impact, so the realistic effect is denial of service (device/modem crash), not code execution or privilege gain - this discrepancy should be verified with UNISOC before treating it as an EoP. EPSS is 1.02% (62nd percentile), i.e. low-to-moderate exploitation probability, consistent with the absence of a CISA KEV listing and no public exploit code. SSVC-style read: exploitation = none observed, technical impact = partial (availability only), automatable is uncertain because 'network' for a baseband processor typically means the radio/air interface rather than routable IP, which materially limits mass automation. Net: a genuine, remotely triggerable DoS against an affected UNISOC modem, but currently a moderate rather than top-tier priority - the 7.5 is driven entirely by availability, and real-world reach depends on attacker radio proximity. Treat as a patch-in-cycle item unless the EoP claim is confirmed.

An attacker within radio range (for example operating a rogue base station or a malicious network node reachable by the modem) sends a crafted, malformed signaling message that the modem fails to validate properly, crashing the baseband and disrupting connectivity. No public exploit code or active exploitation has been identified, so this remains a theoretical but low-complexity remote denial-of-service scenario against the affected chipset.