In the preloader component of MediaTek chipsets a logic flaw allows the reading of device unique identifiers, resulting in local disclosure of sensitive data. The defect does not require any additional privileges or user interaction and aligns with CWE‑522, indicating a failure to protect unique identifiers.

MediaTek, Inc. manufactures a broad range of MT series chipsets, including MT2737, MT6739, MT6761, MT6765, MT6781, MT6813, MT6833, MT6853, MT6877, MT6880, MT6886, MT6890, MT6983, MT6989, MT6993, MT8169, MT8186, MT8190, MT8676, MT8678, MT8696, MT8793, etc. Firmware platforms such as RDK‑B 2022q3 and 2024q1, Yocto 4.0, Android 14‑16, OpenWrt 21.02.0 and 23.05.0, and Zephyr 3.7.0 are also potentially affected. MediaTek has issued Patch ID ALPS10607099, Issue ID MSV‑6118 to remediate the flaw.

The vulnerability carries a CVSS score of 4.6, indicating a medium impact primarily on confidentiality. The EPSS score is below 1 %, suggesting a very low probability of exploitation at present, and it is not listed in the CISA KEV catalog. Exploitation would require physical access to the device and does not depend on remote vulnerabilities or user interaction, making the risk moderate for environments with controlled physical access and modest for well‑protected deployments.