CVE-2024-20017

In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://corp.mediatek.com/product-security-bulletin/March-2024	Vendor Advisory
https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html	Exploit Technical Description Third Party Advisory
https://blog.sonicwall.com/en-us/2024/09/critical-exploit-in-mediatek-wi-fi-chipsets-zero-click-vulnerability-cve-2024-20017-threatens-routers-and-smartphones/	Exploit Third Party Advisory
https://corp.mediatek.com/product-security-bulletin/March-2024	Vendor Advisory
https://news.ycombinator.com/item?id=41605680	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:mediatek:mt7622:-:::::::*
	cpe:2.3:h:mediatek:mt7915:-:::::::*

Configuration 2 (hide)

AND

cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:mediatek:mt7916:-:::::::*
	cpe:2.3:h:mediatek:mt7981:-:::::::*
	cpe:2.3:h:mediatek:mt7986:-:::::::*

Configuration 3 (hide)

AND

OR	cpe:2.3:o:openwrt:openwrt:19.07.0:-::::::
	cpe:2.3:o:openwrt:openwrt:21.02.0:-::::::

cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-03-04 03:15

Updated : 2025-05-05 17:48

NVD link : CVE-2024-20017

Mitre link : CVE-2024-20017

CVE.ORG link : CVE-2024-20017

JSON object : View

Products Affected

mediatek

mt7916
mt6890
mt7986
mt7981
mt7915
mt7622
software_development_kit

openwrt

openwrt

CWE

CWE-20

Improper Input Validation

CWE-787

Out-of-bounds Write

{"id": "CVE-2024-20017", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-03-04T03:15:06.970", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2024", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://blog.sonicwall.com/en-us/2024/09/critical-exploit-in-mediatek-wi-fi-chipsets-zero-click-vulnerability-cve-2024-20017-threatens-routers-and-smartphones/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://corp.mediatek.com/product-security-bulletin/March-2024", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://news.ycombinator.com/item?id=41605680", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132."}, {"lang": "es", "value": "En el servicio WLAN, existe una posible escritura fuera de los l\u00edmites debido a una validaci\u00f3n de entrada incorrecta. Esto podr\u00eda conducir a una escalada local de privilegios sin necesidad de permisos de ejecuci\u00f3n adicionales. No se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n. ID de parche: WCNCR00350938; ID del problema: MSV-1132."}], "lastModified": "2025-05-05T17:48:05.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C3A1278-7DC1-4E66-8F57-4B585A4838ED", "versionEndIncluding": "7.4.0.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt7622:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "55EB4B27-6264-45BE-9A22-BE8418BB0C06"}, {"criteria": "cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3AB22996-9C22-4B6C-9E94-E4C055D16335"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "521ABF30-6B3D-466F-83D4-E2C4297E27C7", "versionEndIncluding": "7.6.7.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DD5AA441-5381-4179-89EB-1642120F72B4"}, {"criteria": "cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "490CD97B-021F-4350-AEE7-A2FA866D5889"}, {"criteria": "cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "40A9E917-4B34-403F-B512-09EEBEA46811"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FA469E2-9E63-4C9A-8EBA-10C8C870063A"}, {"criteria": "cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0133207-2EED-4625-854F-8DB7770D5BF7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}