CVE-2025-20672

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-20672", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2024-11-01T01:21:50.370Z", "datePublished": "2025-06-02T02:29:38.368Z", "dateUpdated": "2026-02-26T18:27:46.417Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2025-06-02T02:29:38.368Z"}, "descriptions": [{"lang": "en", "value": "In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00412257; Issue ID: MSV-3292."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MT7902, MT7921, MT7922, MT7925, MT7927", "versions": [{"version": "NB SDK release 3.6 and before", "status": "affected"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/June-2025"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap Overflow"}]}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-20672", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-03T03:55:10.031208Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T18:27:46.417Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-20672", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-03T03:55:10.031208Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T15:15:42.360Z"}}], "cna": {"affected": [{"vendor": "MediaTek, Inc.", "product": "MT7902, MT7921, MT7922, MT7925, MT7927", "versions": [{"status": "affected", "version": "NB SDK release 3.6 and before"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/June-2025"}], "descriptions": [{"lang": "en", "value": "In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00412257; Issue ID: MSV-3292."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap Overflow"}]}], "providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2025-06-02T02:29:38.368Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20672", "state": "PUBLISHED", "dateUpdated": "2026-02-26T18:27:46.417Z", "dateReserved": "2024-11-01T01:21:50.370Z", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "datePublished": "2025-06-02T02:29:38.368Z", "assignerShortName": "MediaTek"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "MT7902, MT7921, MT7922, MT7925, MT7927", "vendor": "MediaTek, Inc.", "versions": [{"status": "affected", "version": "NB SDK release 3.6 and before"}]}], "source": "security@mediatek.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mediatek:mt7902_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5131A56E-F700-4BA7-A519-C4932B5AA1E5", "versionEndIncluding": "3.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt7902:-:*:*:*:*:*:*:*", "matchCriteriaId": "91DEA745-47A8-43F1-A1B2-F53F651A99EF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mediatek:mt7921_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5FD560ED-2BCE-4BF7-A04C-32218BF95625", "versionEndIncluding": "3.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt7921:-:*:*:*:*:*:*:*", "matchCriteriaId": "32AFEA0A-FFE2-4EA9-8B51-7E3E75DE65CC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mediatek:mt7922_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B04A78CA-39FD-493F-97CD-C4C6E1F9DE54", "versionEndIncluding": "3.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt7922:-:*:*:*:*:*:*:*", "matchCriteriaId": "EA2A6813-7138-441E-A9E4-FF62FCBD797A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mediatek:mt7925_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C73A6DD-48CC-4424-9387-ACBD7E8DD3ED", "versionEndIncluding": "3.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt7925:-:*:*:*:*:*:*:*", "matchCriteriaId": "27CFC9DF-2F4C-469A-8A19-A260B1134CFE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mediatek:mt7927_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B4A41F3-161C-4C98-91FF-5372C1B1D884", "versionEndIncluding": "3.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt7927:-:*:*:*:*:*:*:*", "matchCriteriaId": "05525018-AFE0-415C-A71C-A77922C7D637", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00412257; Issue ID: MSV-3292."}, {"lang": "es", "value": "En el controlador Bluetooth, existe una posible escritura fuera de los l\u00edmites debido a una comprobaci\u00f3n incorrecta de los l\u00edmites. Esto podr\u00eda provocar una escalada local de privilegios, requiriendo permisos de ejecuci\u00f3n del usuario. No se requiere la interacci\u00f3n del usuario para la explotaci\u00f3n. ID de parche: WCNCR00412257; ID de problema: MSV-3292."}], "id": "CVE-2025-20672", "lastModified": "2026-06-17T08:41:48.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20672", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-06-03T03:55:10.031208Z", "version": "2.0.3"}}]}, "published": "2025-06-02T03:15:24.443", "references": [{"source": "security@mediatek.com", "tags": ["Vendor Advisory"], "url": "https://corp.mediatek.com/product-security-bulletin/June-2025"}], "sourceIdentifier": "security@mediatek.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "security@mediatek.com", "type": "Secondary"}]}

{}

{}