Technical impact
A missing permission check in the MediaTek Bluetooth driver creates a privilege bypass that allows local users to gain higher privileges without requiring any user interaction. The flaw is a classic Missing Authorization issue (CWE-862) and can be exploited to elevate a standard user account to an elevated privilege level, potentially compromising the confidentiality, integrity, or availability of the device.
Affected Systems
The vulnerability affects all MediaTek chipset drivers that include the susceptible Bluetooth module. No specific firmware or driver version is listed in the advisory, so all devices running the current Bluetooth driver from MediaTek are at risk.
Risk and Exploitability
Because the issue can be triggered locally on any device with the Bluetooth driver installed, the exploitation window is broad. The CVSS score of 7.8 indicates a high severity, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs local access to the device and does not need to trick the user into enabling Bluetooth. The patch ID WCNCR00488300 indicates that MediaTek has provided a fix that removes the missing check, but devices that have not applied this firmware update remain vulnerable.
