CVE-2025-20674

In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413202; Issue ID: MSV-3303.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://corp.mediatek.com/product-security-bulletin/June-2025	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:openwrt:openwrt:19.07.0:-::::::
	cpe:2.3:o:openwrt:openwrt:21.02.0:-::::::

cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

OR	cpe:2.3:o:openwrt:openwrt:21.02.0:-::::::
	cpe:2.3:o:openwrt:openwrt:23.05:::::::*

cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:mediatek:mt6890:-:::::::*
	cpe:2.3:h:mediatek:mt6990:-:::::::*
	cpe:2.3:h:mediatek:mt7915:-:::::::*
	cpe:2.3:h:mediatek:mt7916:-:::::::*
	cpe:2.3:h:mediatek:mt7981:-:::::::*
	cpe:2.3:h:mediatek:mt7986:-:::::::*
	cpe:2.3:h:mediatek:mt7990:-:::::::*
	cpe:2.3:h:mediatek:mt7992:-:::::::*
	cpe:2.3:h:mediatek:mt7993:-:::::::*

History

No history.

Information

Published : 2025-06-02 03:15

Updated : 2025-07-18 17:16

NVD link : CVE-2025-20674

Mitre link : CVE-2025-20674

CVE.ORG link : CVE-2025-20674

JSON object : View

Products Affected

mediatek

mt6890
mt7916
mt7990
mt7992
mt7986
mt7981
mt7915
mt7993
software_development_kit
mt6990

openwrt

openwrt

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-20674", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-06-02T03:15:24.737", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/June-2025", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413202; Issue ID: MSV-3303."}, {"lang": "es", "value": "En el controlador del punto de acceso WLAN, existe una forma posible de inyectar un paquete arbitrario debido a la falta de verificaci\u00f3n de permisos. Esto podr\u00eda provocar una escalada remota de privilegios sin necesidad de permisos de ejecuci\u00f3n adicionales. No se requiere la interacci\u00f3n del usuario para su explotaci\u00f3n. ID de parche: WCNCR00413202; ID de problema: MSV-3303."}], "lastModified": "2025-07-18T17:16:22.560", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FA469E2-9E63-4C9A-8EBA-10C8C870063A"}, {"criteria": "cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0133207-2EED-4625-854F-8DB7770D5BF7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0133207-2EED-4625-854F-8DB7770D5BF7"}, {"criteria": "cpe:2.3:o:openwrt:openwrt:23.05:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AED95D06-8EC6-4070-BE3C-E0F851D7FFC1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0DD86CC1-BD46-42D2-9112-190CCAC96B30", "versionEndIncluding": "7.6.7.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72"}, {"criteria": "cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}, {"criteria": "cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3AB22996-9C22-4B6C-9E94-E4C055D16335"}, {"criteria": "cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DD5AA441-5381-4179-89EB-1642120F72B4"}, {"criteria": "cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "490CD97B-021F-4350-AEE7-A2FA866D5889"}, {"criteria": "cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "40A9E917-4B34-403F-B512-09EEBEA46811"}, {"criteria": "cpe:2.3:h:mediatek:mt7990:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4901B2A5-B0C8-4A0C-AC17-87D469744817"}, {"criteria": "cpe:2.3:h:mediatek:mt7992:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "50D01D7D-A88D-471D-A23A-42AF4DF82952"}, {"criteria": "cpe:2.3:h:mediatek:mt7993:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "76653163-7627-4C63-A5E2-6277C0EFE23E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}