CRITICAL🇵🇱 Wersja polska

CVE-2024-20100

CVSS 9.8v3.1pub. 2024-10-07upd. 2025-04-25

In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998449; Issue ID: MSV-1603.

🤖 AI Analysis
How it works

The WLAN driver contains an out-of-bounds write error (CWE-787) resulting from improper input validation. An attacker can deliver specially crafted network data that causes writing outside the intended memory area. The exploit requires no privileges on the device or user interaction, making the attack fully remote and hands-off.

Impact

Successful exploitation of this vulnerability can lead to complete takeover of the device through remote code execution (RCE) in the context of the WLAN driver, with potential access to sensitive data, ability to modify it, and disruption of system operation.

Mitigation & patch

Apply patches available from the manufacturer according to the references (Patch ID: ALPS08998449; Issue ID: MSV-1603). Detailed information about affected versions and updates is available in the MediaTek security bulletin from October 2024: https://corp.mediatek.com/product-security-bulletin/October-2024

Who is affected

Devices based on MediaTek chipsets with systems: MediaTek IoT Yocto, MediaTek Software Development Kit (SDK), and Google Android (versions specified in the MediaTek security bulletin from October 2024)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Google Android

    OS
    Google
    12.013.014.0

  • Mediatek Iot Yocto

    APP
    Mediatek
    24.0

  • Mediatek Mt3605

    HW
    Mediatek
    all versions

  • Mediatek Mt6985

    HW
    Mediatek
    all versions

  • Mediatek Mt6989

    HW
    Mediatek
    all versions

  • Mediatek Mt6990

    HW
    Mediatek
    all versions

  • Mediatek Mt7927

    HW
    Mediatek
    all versions

  • Mediatek Mt8183

    HW
    Mediatek
    all versions

  • Mediatek Mt8365

    HW
    Mediatek
    all versions

  • Mediatek Mt8512

    HW
    Mediatek
    all versions

  • Mediatek Mt8676

    HW
    Mediatek
    all versions

  • Mediatek Mt8678

    HW
    Mediatek
    all versions

  • Mediatek Mt8695

    HW
    Mediatek
    all versions

  • Mediatek Mt8698

    HW
    Mediatek
    all versions

  • Mediatek Mt8755

    HW
    Mediatek
    all versions

  • Mediatek Mt8775

    HW
    Mediatek
    all versions

  • Mediatek Mt8792

    HW
    Mediatek
    all versions

  • Mediatek Mt8796

    HW
    Mediatek
    all versions

  • Mediatek Software Development Kit

    APP
    Mediatek
    ≤ 3.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2020-16010CRITICAL9.6⚠ KEVPL ✓same product

Heap buffer overflow w Google Chrome na Android — sandbox escape

CVE-2016-1019CRITICAL9.8⚠ KEVPL ✓same product

Adobe Flash Player — RCE lub DoS przez nieokreślone wektory ataku

CVE-2026-78937CRITICAL9.6same product

Use after free in Search in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker lever...

CVE-2026-79129CRITICAL9.6same product

Use after free in Sessions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker lev...

CVE-2026-79152CRITICAL9.8same product

Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local at...