In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09474894; Issue ID: MSV-2597.

No CVSS v4.0

Attack Vector Physical

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0004.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
MediaTek, Inc. MT2718, MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT6886, MT6895, MT6897, MT6983, MT6985, MT6989, MT8196, MT8673, MT8676, MT8678, MT8781 affected
Version Status Constraints
Android 12.0, 13.0, 14.0, 15.0 affected —

Configuration 1 [-]

AND
OR cpe:2.3:o:google:android:12.0:-:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:-:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
OR cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Google Subscribe
Android Subscribe
Mediatek Subscribe
Mt2718 Subscribe
Mt6781 Subscribe
Mt6789 Subscribe
Mt6835 Subscribe
Mt6855 Subscribe
Mt6878 Subscribe
Mt6879 Subscribe
Mt6886 Subscribe
Mt6895 Subscribe
Mt6897 Subscribe
Mt6983 Subscribe
Mt6985 Subscribe
Mt6989 Subscribe
Mt8196 Subscribe
Mt8673 Subscribe
Mt8676 Subscribe
Mt8678 Subscribe
Mt8781 Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2025-9972 In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09474894; Issue ID: MSV-2597.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://corp.mediatek.com/product-security-bulletin/April-2025 cve-icon cve-icon
History

Wed, 09 Apr 2025 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Mediatek
Mediatek mt2718
Mediatek mt6781
Mediatek mt6789
Mediatek mt6835
Mediatek mt6855
Mediatek mt6878
Mediatek mt6879
Mediatek mt6886
Mediatek mt6895
Mediatek mt6897
Mediatek mt6983
Mediatek mt6985
Mediatek mt6989
Mediatek mt8196
Mediatek mt8673
Mediatek mt8676
Mediatek mt8678
Mediatek mt8781
CPEs cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:12.0:-:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:-:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
Vendors & Products Google
Google android
Mediatek
Mediatek mt2718
Mediatek mt6781
Mediatek mt6789
Mediatek mt6835
Mediatek mt6855
Mediatek mt6878
Mediatek mt6879
Mediatek mt6886
Mediatek mt6895
Mediatek mt6897
Mediatek mt6983
Mediatek mt6985
Mediatek mt6989
Mediatek mt8196
Mediatek mt8673
Mediatek mt8676
Mediatek mt8678
Mediatek mt8781

Mon, 07 Apr 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 07 Apr 2025 03:30:00 +0000

Type Values Removed Values Added
Description In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09474894; Issue ID: MSV-2597.
Weaknesses CWE-787
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: MediaTek

Published:

Updated: 2025-04-07T18:22:01.666Z

Reserved: 2024-11-01T01:21:50.367Z

Link: CVE-2025-20658

cve-icon Vulnrichment

Updated: 2025-04-07T14:20:08.333Z

cve-icon NVD

Status : Analyzed

Published: 2025-04-07T04:15:19.703

Modified: 2025-04-09T15:20:15.973

Link: CVE-2025-20658

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses