CVE-2025-20674

Published Jun 2, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413202; Issue ID: MSV-3303.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MediaTek, Inc.

MT6890, MT6990, MT7915, MT7916, MT7981, MT7986, MT7990, MT7992, MT7993

affected

Version	Status	Constraints
`SDK release 7.6.7.2 and before / OpenWrt 19.07, 21.02 (MT6890) / OpenWrt 21.02, 23.05 (MT6990)`	affected	—

Configuration 1 [-]

AND

OR	cpe:2.3:o:openwrt:openwrt:19.07.0:-::::::
	cpe:2.3:o:openwrt:openwrt:21.02.0:-::::::

cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:openwrt:openwrt:21.02.0:-::::::
	cpe:2.3:o:openwrt:openwrt:23.05:::::::*

cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:mediatek:mt6890:-:::::::*
	cpe:2.3:h:mediatek:mt6990:-:::::::*
	cpe:2.3:h:mediatek:mt7915:-:::::::*
	cpe:2.3:h:mediatek:mt7916:-:::::::*
	cpe:2.3:h:mediatek:mt7981:-:::::::*
	cpe:2.3:h:mediatek:mt7986:-:::::::*
	cpe:2.3:h:mediatek:mt7990:-:::::::*
	cpe:2.3:h:mediatek:mt7992:-:::::::*
	cpe:2.3:h:mediatek:mt7993:-:::::::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-16597	In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413202; Issue ID: MSV-3303.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.791% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://corp.mediatek.com/product-security-bulletin/June-2025

History

Jul 18, 2025 5:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mediatek software Development Kit
CPEs	cpe:2.3:o:mediatek:mt7915_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7916_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7981_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7986_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7990_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7992_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7993_firmware:7.6.7.2:::::::*	cpe:2.3:a:mediatek:software_development_kit::::::::
Vendors & Products	Mediatek mt7915 Firmware Mediatek mt7916 Firmware Mediatek mt7981 Firmware Mediatek mt7986 Firmware Mediatek mt7990 Firmware Mediatek mt7992 Firmware Mediatek mt7993 Firmware	Mediatek software Development Kit

Jul 2, 2025 4:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mediatek Mediatek mt6890 Mediatek mt6990 Mediatek mt7915 Mediatek mt7915 Firmware Mediatek mt7916 Mediatek mt7916 Firmware Mediatek mt7981 Mediatek mt7981 Firmware Mediatek mt7986 Mediatek mt7986 Firmware Mediatek mt7990 Mediatek mt7990 Firmware Mediatek mt7992 Mediatek mt7992 Firmware Mediatek mt7993 Mediatek mt7993 Firmware Openwrt Openwrt openwrt
CPEs		cpe:2.3:h:mediatek:mt6890:-:::::::* cpe:2.3:h:mediatek:mt6990:-:::::::* cpe:2.3:h:mediatek:mt7915:-:::::::* cpe:2.3:h:mediatek:mt7916:-:::::::* cpe:2.3:h:mediatek:mt7981:-:::::::* cpe:2.3:h:mediatek:mt7986:-:::::::* cpe:2.3:h:mediatek:mt7990:-:::::::* cpe:2.3:h:mediatek:mt7992:-:::::::* cpe:2.3:h:mediatek:mt7993:-:::::::* cpe:2.3:o:mediatek:mt7915_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7916_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7981_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7986_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7990_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7992_firmware:7.6.7.2:::::::* cpe:2.3:o:mediatek:mt7993_firmware:7.6.7.2:::::::* cpe:2.3:o:openwrt:openwrt:19.07.0:-:::::: cpe:2.3:o:openwrt:openwrt:21.02.0:-:::::: cpe:2.3:o:openwrt:openwrt:23.05:::::::*
Vendors & Products		Mediatek Mediatek mt6890 Mediatek mt6990 Mediatek mt7915 Mediatek mt7915 Firmware Mediatek mt7916 Mediatek mt7916 Firmware Mediatek mt7981 Mediatek mt7981 Firmware Mediatek mt7986 Mediatek mt7986 Firmware Mediatek mt7990 Mediatek mt7990 Firmware Mediatek mt7992 Mediatek mt7992 Firmware Mediatek mt7993 Mediatek mt7993 Firmware Openwrt Openwrt openwrt

Jun 2, 2025 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 2, 2025 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Jun 2, 2025 3:15 AM Description updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413202; Issue ID: MSV-3303.
Weaknesses		CWE-863
References		https://corp.mediatek.com/product-security-bulletin/June-2025