CVE-2024-20017 - OpenCVE

In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Mediatek	Mt6890 Mt7915 Mt7916 Mt7981 Mt7986

No data.

No data.

References

Link	Providers
https://corp.mediatek.com/product-security-bulletin/March-2024

History

Tue, 24 Sep 2024 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Sat, 21 Sep 2024 04:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mediatek Mediatek mt6890 Mediatek mt7915 Mediatek mt7916 Mediatek mt7981 Mediatek mt7986
CPEs		cpe:2.3:h:mediatek:mt6890:-:::::::* cpe:2.3:h:mediatek:mt7915:-:::::::* cpe:2.3:h:mediatek:mt7916:-:::::::* cpe:2.3:h:mediatek:mt7981:-:::::::* cpe:2.3:h:mediatek:mt7986:-:::::::*
Vendors & Products		Mediatek Mediatek mt6890 Mediatek mt7915 Mediatek mt7916 Mediatek mt7981 Mediatek mt7986
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 26 Aug 2024 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: MediaTek

Published: 2024-03-04T02:43:22.997Z

Updated: 2024-09-25T03:55:42.993Z

Reserved: 2023-11-02T13:35:35.150Z

Link: CVE-2024-20017

Vulnrichment

Updated: 2024-09-21T16:54:41.063Z

NVD

Status : Awaiting Analysis

Published: 2024-03-04T03:15:06.970

Modified: 2024-09-25T01:36:50.810

Link: CVE-2024-20017

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-20017", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2023-11-02T13:35:35.150Z", "datePublished": "2024-03-04T02:43:22.997Z", "dateUpdated": "2024-09-25T03:55:42.993Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2024-03-07T02:16:46.885Z"}, "descriptions": [{"lang": "en", "value": "In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MT6890, MT7915, MT7916, MT7981, MT7986", "versions": [{"version": "SDK version 7.4.0.1 and before (for MT7915) / SDK version 7.6.7.0 and before (for MT7916, MT7981 and MT7986) / OpenWrt 19.07, 21.02", "status": "affected"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2024"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Elevation of Privilege"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-21T16:54:41.063Z"}, "references": [{"url": "https://blog.sonicwall.com/en-us/2024/09/critical-exploit-in-mediatek-wi-fi-chipsets-zero-click-vulnerability-cve-2024-20017-threatens-routers-and-smartphones/"}, {"url": "https://news.ycombinator.com/item?id=41605680"}, {"url": "https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html"}, {"tags": ["x_transferred"], "url": "https://corp.mediatek.com/product-security-bulletin/March-2024"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}], "affected": [{"vendor": "mediatek", "product": "mt6890", "cpes": ["cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt7915", "cpes": ["cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt7916", "cpes": ["cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt7981", "cpes": ["cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "mediatek", "product": "mt7986", "cpes": ["cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-24T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-20017"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-25T03:55:42.993Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://blog.sonicwall.com/en-us/2024/09/critical-exploit-in-mediatek-wi-fi-chipsets-zero-click-vulnerability-cve-2024-20017-threatens-routers-and-smartphones/"}, {"url": "https://news.ycombinator.com/item?id=41605680"}, {"url": "https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html"}, {"url": "https://corp.mediatek.com/product-security-bulletin/March-2024", "tags": ["x_transferred"]}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-21T16:54:41.063Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-20017", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-26T20:59:14.425064Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt6890", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt7915", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt7916", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt7981", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt7986", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-26T20:54:05.912Z"}}], "cna": {"affected": [{"vendor": "MediaTek, Inc.", "product": "MT6890, MT7915, MT7916, MT7981, MT7986", "versions": [{"status": "affected", "version": "SDK version 7.4.0.1 and before (for MT7915) / SDK version 7.6.7.0 and before (for MT7916, MT7981 and MT7986) / OpenWrt 19.07, 21.02"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2024"}], "descriptions": [{"lang": "en", "value": "In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Elevation of Privilege"}]}], "providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2024-03-07T02:16:46.885Z"}}}, "cveMetadata": {"cveId": "CVE-2024-20017", "state": "PUBLISHED", "dateUpdated": "2024-09-25T03:55:42.993Z", "dateReserved": "2023-11-02T13:35:35.150Z", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "datePublished": "2024-03-04T02:43:22.997Z", "assignerShortName": "MediaTek"}, "dataVersion": "5.1"}