Technical impact
The vulnerability exists in MediaTek modem firmware and allows an out‑of‑bounds write when a bounds check is omitted. This flaw can let an attacker elevate privileges on a device that connects to a rogue base station. No additional execution privileges are required, but the victim must interact with or accept a connection for exploitation. The result is compromise of device integrity and potential further system compromise.
Affected Systems
Any device that incorporates MediaTek MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791t, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893 chipsets running the affected modem firmware are impacted. The specific firmware revision numbers are not disclosed in the advisory, so any device that can connect to cellular networks is at risk.
Risk and Exploitability
The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a low exploitation probability under normal circumstances. The CVSS base score of 7.1 reflects high severity, with user interaction required. Because the flaw is an out‑of‑bounds write identified as CWE‑787, once exploited it can provide the attacker with elevated privileges on the affected device, enabling further compromise.
