9.8 Critical

CVE-2024-20017 In wlan service, there is a possible out of bounds write due to improper input validation

Description

In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
mt6890	Versions not published
mt7915	Versions not published
mt7916	Versions not published
mt7981	Versions not published
mt7986	Versions not published
MT6890, MT7915, MT7916, MT7981, MT7986	Versions not published

References

corp.mediatek.com corp.mediatek.com

Timeline

Published March 4, 2024
Last modified November 3, 2026

The 27 CVEs of mt6890 →

CVE-2024-20137 In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions 7.5 High CVE-2024-20136 In da, there is a possible out of bounds read due to a missing bounds check 6.2 Medium CVE-2024-20104 In da, there is a possible out of bounds write due to a missing bounds check 8.4 High CVE-2024-20094 In Modem, there is a possible system crash due to a missing bounds check 7.5 High

Track this CVE