Technical impact
The defect is a missing permission check within MediaTek’s geniezone component. A malicious actor who already holds System privilege can exploit this flaw to elevate privileges further without any user interaction. The core weakness is a failure to enforce an authorization boundary, allowing unauthorized privilege escalation.
Affected Systems
This vulnerability impacts MediaTek, Inc.’s MediaTek chipset family. No specific version range is disclosed in the advisory, so all models using the geniezone software are potentially affected. Users of these chipsets should consider the possibility of exploitation if the device can enter a System‑privileged state.
Risk and Exploitability
The CVSS score of 6.0 classifies this as a moderate‑severity vulnerability, while the EPSS score of < 1% suggests a low chance of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating that broad, automated exploitation is not currently known. The flaw is purely local and requires that the attacker already possesses System privilege or a means to acquire it. Consequently, direct remote exploitation is unlikely; however, any local compromise that grants System access could be leveraged to hijack the device’s privileges.
