CVE-2025-61609: 
NixOS vulnerability analysis and mitigation

CVE-2025-61609 is an improper input validation vulnerability in the modem component of Unisoc chipsets (T8100/T9100/T8200/T8300) that can cause a system crash, leading to remote denial of service. It affects Android versions 13, 14, 15, and 16 running on affected Unisoc hardware. The vulnerability was disclosed on December 1, 2025, as part of the Google Android December 2025 Security Bulletin. It carries a CVSS v3.1 base score of 7.5 (High) (Android Bulletin, Unisoc Advisory).

The root cause is improper input validation (CWE-20) in the modem component of Unisoc T8100/T9100/T8200/T8300 chipsets. An unauthenticated remote attacker can send malformed network input to the modem, triggering a system crash without requiring any execution privileges or user interaction. The attack vector is network-accessible, with low complexity, making it straightforward to exploit against vulnerable devices (Android Bulletin, Unisoc Advisory).

Successful exploitation results in a system crash on the affected Android device, causing a complete loss of availability — including disruption of device communication and connectivity. There is no confidentiality or integrity impact; the vulnerability is limited to a denial-of-service condition. Because no privileges are required and no user interaction is needed, any device with an affected Unisoc modem exposed to network traffic is at risk (Android Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.153%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Android Bulletin, Unisoc Advisory).

Apply the December 2025 Android Security Patch (2025-12-01 patch level) as released in the Google Android Security Bulletin, which addresses this vulnerability for Unisoc T8100/T9100/T8200/T8300 devices running Android 13–16. Verify that device firmware has been updated to the patched version via device settings. As a supplementary measure, implement network-level filtering to block anomalous traffic targeting the modem component, and monitor network traffic for suspicious patterns (Android Bulletin, Unisoc Advisory).

The vulnerability was noted in coverage of Google's December 2025 Android Security Bulletin, which addressed over 100 vulnerabilities. Community and media attention was limited, consistent with the absence of active exploitation or a public PoC (BeyondMachines).