CVE-2025-61615: 
NixOS vulnerability analysis and mitigation

CVE-2025-61615 is an improper input validation vulnerability in the NR (New Radio/5G) modem component affecting Android devices powered by Unisoc chipsets (T8100, T9100, T8200, T8300). The flaw can cause a system crash, leading to remote denial of service with no privileges or user interaction required. Affected Android versions include 13.0, 14.0, 15.0, and 16.0. It was published on March 9, 2026, and addressed in the March 2026 Android Security Bulletin. The CVSS v3.1 base score is 7.5 (High) (Android Bulletin, Unisoc Advisory).

The vulnerability is classified as CWE-20 (Improper Input Validation) and resides in the NR modem firmware component of Unisoc chipsets. An unauthenticated remote attacker can send malformed or unexpected input over the network to the modem, triggering insufficient validation logic that results in a system crash. No privileges or user interaction are required, and the attack vector is network-based with low complexity, making it straightforward to trigger remotely (Android Bulletin, Unisoc Advisory).

Successful exploitation results in a device system crash, causing a complete loss of availability for the affected Android device — effectively a remote denial of service. There is no impact on confidentiality or integrity, as the vulnerability does not enable code execution or data access. Affected devices include those running Android 13 through 16 on Unisoc T8100, T9100, T8200, and T8300 chipsets (Android Bulletin, Unisoc Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Android Bulletin). No threat actor attribution has been reported. The EPSS score is approximately 0.20%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Google addressed this vulnerability in the March 2026 Android Security Bulletin (patch level 2026-03-01), and Unisoc has released a corresponding advisory. Users and device manufacturers should apply the March 2026 security update to affected Android 13, 14, 15, and 16 devices with Unisoc chipsets. No configuration-based workaround is publicly documented; updating to the patched firmware is the recommended remediation (Android Bulletin, Unisoc Advisory).

The vulnerability received routine coverage in the security community following the March 2026 Android Security Bulletin release, with automated CVE tracking services and social media accounts (Bluesky, Mastodon) noting its publication. No notable independent researcher commentary or significant media coverage beyond standard bulletin aggregation has been identified.