Vulnerabilites related to mediatek - mt8883
CVE-2025-20698 (GCVE-0-2025-20698)
Vulnerability from cvelistv5
Published
2025-08-04 01:49
Modified
2025-08-05 03:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-787 - Out-of-bounds Write
Summary
In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915400; Issue ID: MSV-3793.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20698",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-05T03:56:12.301Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT8186, MT8196, MT8391, MT8676, MT8678, MT8775, MT8786, MT8788E, MT8792, MT8796, MT8873, MT8883, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 13.0, 14.0, 15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915400; Issue ID: MSV-3793."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T01:49:50.189Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/August-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20698",
"datePublished": "2025-08-04T01:49:50.189Z",
"dateReserved": "2024-11-01T01:21:50.382Z",
"dateUpdated": "2025-08-05T03:56:12.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-20703 (GCVE-0-2025-20703)
Vulnerability from cvelistv5
Published
2025-09-01 05:12
Modified
2025-09-02 14:07
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-125 - Out-of-bounds Read
Summary
In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01599794; Issue ID: MSV-3708.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20703",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-02T14:06:48.189265Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-02T14:07:22.380Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2735, MT2737, MT6813, MT6833, MT6833P, MT6835, MT6835T, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6878, MT6878M, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895TT, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6983T, MT6985, MT6985T, MT6989, MT6989T, MT6990, MT6991, MT8673, MT8675, MT8676, MT8678, MT8771, MT8791, MT8791T, MT8792, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Modem NR15, NR16, NR17, NR17R"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01599794; Issue ID: MSV-3708."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-01T05:12:17.909Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20703",
"datePublished": "2025-09-01T05:12:17.909Z",
"dateReserved": "2024-11-01T01:21:50.383Z",
"dateUpdated": "2025-09-02T14:07:22.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-20678 (GCVE-0-2025-20678)
Vulnerability from cvelistv5
Published
2025-06-02 02:29
Modified
2025-06-02 15:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-674 - Uncontrolled Recursion
Summary
In ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01394606; Issue ID: MSV-2739.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20678",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-02T15:21:06.886934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T15:46:17.386Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT6739, MT6761, MT6762, MT6762D, MT6762M, MT6763, MT6765, MT6765T, MT6767, MT6768, MT6769, MT6769K, MT6769S, MT6769T, MT6769Z, MT6771, MT6779, MT6781, MT6783, MT6785, MT6785T, MT6785U, MT6789, MT6813, MT6833, MT6833P, MT6835, MT6835T, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6878, MT6878M, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895TT, MT6896, MT6897, MT6899, MT6980, MT6983, MT6983T, MT6985, MT6985T, MT6989, MT6989T, MT6990, MT6991, MT8666, MT8667, MT8673, MT8675, MT8676, MT8678, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8791, MT8791T, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Modem LR12A, LR13, NR15, NR16, NR17, NR17R"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01394606; Issue ID: MSV-2739."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T02:29:47.843Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/June-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20678",
"datePublished": "2025-06-02T02:29:47.843Z",
"dateReserved": "2024-11-01T01:21:50.371Z",
"dateUpdated": "2025-06-02T15:46:17.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-20708 (GCVE-0-2025-20708)
Vulnerability from cvelistv5
Published
2025-09-01 05:12
Modified
2025-09-03 03:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-787 - Out-of-bounds Write
Summary
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01123853; Issue ID: MSV-4131.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20708",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-02T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-03T03:55:30.011Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2735, MT2737, MT6813, MT6815, MT6833, MT6833P, MT6835, MT6835T, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6878, MT6878M, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895TT, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6983T, MT6985, MT6985T, MT6989, MT6989T, MT6990, MT6991, MT8673, MT8675, MT8676, MT8678, MT8771, MT8791, MT8791T, MT8792, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Modem NR15, NR16, NR17, NR17R"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01123853; Issue ID: MSV-4131."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-01T05:12:16.345Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20708",
"datePublished": "2025-09-01T05:12:16.345Z",
"dateReserved": "2024-11-01T01:21:50.383Z",
"dateUpdated": "2025-09-03T03:55:30.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-20704 (GCVE-0-2025-20704)
Vulnerability from cvelistv5
Published
2025-09-01 05:12
Modified
2025-09-03 03:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-787 - Out-of-bounds Write
Summary
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01516959; Issue ID: MSV-3502.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT6813, MT6835, MT6835T, MT6878, MT6878M, MT6897, MT6899, MT6991, MT8676, MT8678, MT8792, MT8863, MT8873, MT8883 |
Version: Modem NR17, NR17R |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-02T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-03T03:55:28.946Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT6813, MT6835, MT6835T, MT6878, MT6878M, MT6897, MT6899, MT6991, MT8676, MT8678, MT8792, MT8863, MT8873, MT8883",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Modem NR17, NR17R"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01516959; Issue ID: MSV-3502."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-01T05:12:19.494Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20704",
"datePublished": "2025-09-01T05:12:19.494Z",
"dateReserved": "2024-11-01T01:21:50.383Z",
"dateUpdated": "2025-09-03T03:55:28.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-20697 (GCVE-0-2025-20697)
Vulnerability from cvelistv5
Published
2025-08-04 01:49
Modified
2025-08-05 03:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-787 - Out-of-bounds Write
Summary
In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915681; Issue ID: MSV-3795.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20697",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-05T03:56:07.647Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT6761, MT6765, MT6768, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6889, MT6893, MT6897, MT6989, MT6991, MT8186, MT8196, MT8391, MT8678, MT8775, MT8786, MT8788E, MT8792, MT8796, MT8873, MT8883, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 14.0, 15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915681; Issue ID: MSV-3795."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T01:49:48.567Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/August-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20697",
"datePublished": "2025-08-04T01:49:48.567Z",
"dateReserved": "2024-11-01T01:21:50.381Z",
"dateUpdated": "2025-08-05T03:56:07.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-20707 (GCVE-0-2025-20707)
Vulnerability from cvelistv5
Published
2025-09-01 05:12
Modified
2025-09-03 03:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-416 - Use After Free
Summary
In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09924201; Issue ID: MSV-3820.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT2718, MT6853, MT6877, MT6893, MT6899, MT6991, MT8196, MT8676, MT8678, MT8775, MT8786, MT8788E, MT8791T, MT8792, MT8796, MT8883, MT8893 |
Version: Android 13.0, 14.0, 15.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20707",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-02T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-03T03:55:25.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT6853, MT6877, MT6893, MT6899, MT6991, MT8196, MT8676, MT8678, MT8775, MT8786, MT8788E, MT8791T, MT8792, MT8796, MT8883, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 13.0, 14.0, 15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09924201; Issue ID: MSV-3820."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-01T05:12:24.351Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20707",
"datePublished": "2025-09-01T05:12:24.351Z",
"dateReserved": "2024-11-01T01:21:50.383Z",
"dateUpdated": "2025-09-03T03:55:25.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2025-06-02 03:15
Modified
2025-07-10 17:38
Severity ?
Summary
In ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01394606; Issue ID: MSV-2739.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@mediatek.com | https://corp.mediatek.com/product-security-bulletin/June-2025 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mediatek:lr12a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A4B6AFD8-6CBA-4A1D-B38F-A9ABFEB6EFC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:lr13:-:*:*:*:*:*:*:*",
"matchCriteriaId": "12318A0A-16CD-48A5-98A4-373070734642",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E30A2D2E-6A72-4070-A471-EEE75F7D07F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr16:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B763B71-F913-45B4-B91E-D7F0670C4315",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr17:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66F8874B-DBF1-4A67-8ADF-4654AB56B6A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr17r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BC63582A-F9A5-4450-A263-CE1FD4B4F3AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7FA8A390-9F52-4CF3-9B45-936CE3E2B828",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F726F486-A86F-4215-AD93-7A07A071844A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C445EB80-6021-4E26-B74E-1B4B6910CE48",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6762d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "160C2DDD-6CA5-4E4F-B885-C8AAA7D1D942",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6762m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0002C537-4268-43CA-B349-BC14F1F0313C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2F19C76A-50DF-4ACA-BACA-07157B4D838B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*",
"matchCriteriaId": "43E779F6-F0A0-4153-9A1D-B715C3A2F80E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6765t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE80B083-D5A3-418C-9655-C79C9DECB4C5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3367BA13-9C4D-4CCF-8E71-397F33CFF773",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*",
"matchCriteriaId": "06CD97E1-8A76-48B4-9780-9698EF5A960F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D23991D5-1893-49F4-8A06-D5E66C96C3B3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6769k:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B0EFB31-7B79-4529-A978-FA227D77F9F4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6769s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DD67454-1786-4BC7-B97E-96898F5FE3AF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6769t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B43D63CF-FF77-41D8-BA4B-F8BDF88830BA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6769z:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1BE913-70AE-49FE-99E9-E996165DF79D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE4D2AED-C713-407F-A34A-52C3D8F65835",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EBA369B8-8E23-492B-82CC-23114E6A5D1C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C4EEE021-6B2A-47A0-AC6B-55525A40D718",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C8F9C2-6471-4498-B089-2F40D2483487",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A82E0A4F-072F-474C-B94C-8114ABE05639",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6785t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E208C7B7-7BF6-4E56-B61C-0198B08DC8B3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6785u:-:*:*:*:*:*:*:*",
"matchCriteriaId": "14DD4149-ACBE-47B8-B52E-7CE8EECA3615",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B9B0D82-82C1-4A77-A016-329B99C45F49",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9814939B-F05E-4870-90C0-7C0F6BAAEB39",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6833p:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CB690F5A-9367-45D3-A53E-80BF60053630",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*",
"matchCriteriaId": "19A63103-C708-48EC-B44D-5E465A6B79C5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6835t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7FE7DBA-479C-402B-8485-9D14E70F25EB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*",
"matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "328DA6BE-1303-4646-89B7-2EC8DC444532",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6855t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "083F6134-FF26-4F1B-9B77-971D342AF774",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*",
"matchCriteriaId": "80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6875t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F883C6D3-1724-4553-9EFC-3D204FF3CAA3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EFA54AA1-4E3A-44F8-A222-31C60F8F81DA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877tt:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5D4D6885-E18C-477F-8B6D-B9E84D9535E2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*",
"matchCriteriaId": "855A8046-34ED-4891-ACE5-76AB10AC8D53",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6878m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "483B6FB0-D683-4F3C-BA5B-6C9852179854",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704BE5CE-AE08-4432-A8B0-4C8BD62148AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68CF4A7A-3136-4C4C-A795-81323896BE11",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15E2EC3F-9FB3-488B-B1C1-2793A416C755",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD64413C-C774-4C4F-9551-89E1AA9469EE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF3E2B84-DAFE-4E11-B23B-026F719475F5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B787DC3-8E5A-4968-B20B-37B6257FAAE2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*",
"matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D8E91CA4-CA5B-40D1-9A96-2B875104BCF4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "213B5C7F-D965-4312-9CDF-4F06FA77D401",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0CA45C9-7BFE-4C93-B2AF-B86501F763AB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6895tt:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2141B30A-C56F-4831-8FCD-4758DF97AD18",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33DEF766-EAF1-4E36-BB7C-43069B26507A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2A7D8055-F4B6-41EE-A078-11D56285AB66",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA9131F6-F167-4FD7-8FBF-B372CBBCF46F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6983t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7D6430E-840D-447F-892E-EA4FD7F69BAF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6985t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DEBB2AE0-F6CD-4CAF-BBF2-09C5C20B9910",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AD7DE6B2-66D9-4A3E-B15F-D56505559255",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6989t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6309AE48-7266-435C-B906-50960F643FC8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1A76806D-A4E3-466A-90CB-E9FFE478E7A0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBBB30DF-E963-4940-B742-F6801F68C3FC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8666:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6C9AB4D2-0EDD-4D5E-9393-F535CA2F24C4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8667:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2FE14B46-C1CA-465F-8578-059FA2ED30EB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152F6606-FA23-4530-AA07-419866B74CB3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*",
"matchCriteriaId": "03E6123A-7603-4EAB-AFFB-229E8A040709",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EE302F6F-170E-4350-A8F4-65BE0C50CB78",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152A5F3D-8004-4649-BDB1-E6F0798AF1CB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3AACF35D-27E0-49AF-A667-13585C8B8071",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CE45F606-2E75-48BC-9D1B-99D504974CBF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "738475DC-9FA8-4034-AB1F-F89C77CE7B41",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D09F23D-D023-4A60-B426-61251FDD8A5A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*",
"matchCriteriaId": "533284E5-C3AF-48D3-A287-993099DB2E41",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE10C121-F2AD-43D2-8FF9-A6C197858220",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CEDF887A-1862-4336-ABFC-371838E1D029",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1505AD53-987E-4328-8E1D-F5F1EC12B677",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9CD2C3EC-B62D-4616-964F-FDBE5B14A449",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1BB05B1D-77C9-4E42-91AD-9F087413DC20",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78D4E9E1-B044-41EC-BE98-22DC0E5E9010",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B469BF4-5961-42E9-814B-1BE06D182E45",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*",
"matchCriteriaId": "637CAAD2-DCC0-4F81-B781-5D0536844CA8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77E0D738-F0B9-468F-8A10-204F498320BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D6DD525F-7050-42BD-829D-1121698B8009",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23DD8281-FEB4-4E23-8DDA-680FF895F12E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFAADB1-C2B2-47A6-BB66-761B964E7DFB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01394606; Issue ID: MSV-2739."
},
{
"lang": "es",
"value": "En el servicio ims, existe un posible fallo del sistema debido a una gesti\u00f3n incorrecta de errores. Esto podr\u00eda provocar una denegaci\u00f3n de servicio remota si un UE se conecta a una estaci\u00f3n base no autorizada controlada por el atacante, sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se requiere la interacci\u00f3n del usuario para su explotaci\u00f3n. ID de parche: MOLY01394606; ID de problema: MSV-2739."
}
],
"id": "CVE-2025-20678",
"lastModified": "2025-07-10T17:38:15.050",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-06-02T03:15:25.230",
"references": [
{
"source": "security@mediatek.com",
"tags": [
"Vendor Advisory"
],
"url": "https://corp.mediatek.com/product-security-bulletin/June-2025"
}
],
"sourceIdentifier": "security@mediatek.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-674"
}
],
"source": "security@mediatek.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-09-01 06:15
Modified
2025-09-03 16:07
Severity ?
Summary
In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01599794; Issue ID: MSV-3708.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@mediatek.com | https://corp.mediatek.com/product-security-bulletin/September-2025 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E30A2D2E-6A72-4070-A471-EEE75F7D07F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr16:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B763B71-F913-45B4-B91E-D7F0670C4315",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr17:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66F8874B-DBF1-4A67-8ADF-4654AB56B6A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr17r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BC63582A-F9A5-4450-A263-CE1FD4B4F3AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C2A1118-B5F7-4EF5-B329-0887B5F3430E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9814939B-F05E-4870-90C0-7C0F6BAAEB39",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6833p:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CB690F5A-9367-45D3-A53E-80BF60053630",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*",
"matchCriteriaId": "19A63103-C708-48EC-B44D-5E465A6B79C5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6835t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7FE7DBA-479C-402B-8485-9D14E70F25EB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*",
"matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "328DA6BE-1303-4646-89B7-2EC8DC444532",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6855t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "083F6134-FF26-4F1B-9B77-971D342AF774",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*",
"matchCriteriaId": "80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6875t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F883C6D3-1724-4553-9EFC-3D204FF3CAA3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EFA54AA1-4E3A-44F8-A222-31C60F8F81DA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877tt:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5D4D6885-E18C-477F-8B6D-B9E84D9535E2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*",
"matchCriteriaId": "855A8046-34ED-4891-ACE5-76AB10AC8D53",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6878m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "483B6FB0-D683-4F3C-BA5B-6C9852179854",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704BE5CE-AE08-4432-A8B0-4C8BD62148AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68CF4A7A-3136-4C4C-A795-81323896BE11",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15E2EC3F-9FB3-488B-B1C1-2793A416C755",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD64413C-C774-4C4F-9551-89E1AA9469EE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF3E2B84-DAFE-4E11-B23B-026F719475F5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B787DC3-8E5A-4968-B20B-37B6257FAAE2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*",
"matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D8E91CA4-CA5B-40D1-9A96-2B875104BCF4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "213B5C7F-D965-4312-9CDF-4F06FA77D401",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0CA45C9-7BFE-4C93-B2AF-B86501F763AB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6895tt:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2141B30A-C56F-4831-8FCD-4758DF97AD18",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33DEF766-EAF1-4E36-BB7C-43069B26507A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2A7D8055-F4B6-41EE-A078-11D56285AB66",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA9131F6-F167-4FD7-8FBF-B372CBBCF46F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6980d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2758122C-4D11-4D34-9B72-3905F3A28448",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6983t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7D6430E-840D-447F-892E-EA4FD7F69BAF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6985t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DEBB2AE0-F6CD-4CAF-BBF2-09C5C20B9910",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AD7DE6B2-66D9-4A3E-B15F-D56505559255",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6989t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6309AE48-7266-435C-B906-50960F643FC8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1A76806D-A4E3-466A-90CB-E9FFE478E7A0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBBB30DF-E963-4940-B742-F6801F68C3FC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152F6606-FA23-4530-AA07-419866B74CB3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*",
"matchCriteriaId": "03E6123A-7603-4EAB-AFFB-229E8A040709",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EE302F6F-170E-4350-A8F4-65BE0C50CB78",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152A5F3D-8004-4649-BDB1-E6F0798AF1CB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D09F23D-D023-4A60-B426-61251FDD8A5A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9CD2C3EC-B62D-4616-964F-FDBE5B14A449",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1BB05B1D-77C9-4E42-91AD-9F087413DC20",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*",
"matchCriteriaId": "336FC69E-E89F-4642-B6B9-8009D9A2BD52",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78D4E9E1-B044-41EC-BE98-22DC0E5E9010",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B469BF4-5961-42E9-814B-1BE06D182E45",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*",
"matchCriteriaId": "637CAAD2-DCC0-4F81-B781-5D0536844CA8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77E0D738-F0B9-468F-8A10-204F498320BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D6DD525F-7050-42BD-829D-1121698B8009",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23DD8281-FEB4-4E23-8DDA-680FF895F12E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFAADB1-C2B2-47A6-BB66-761B964E7DFB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01599794; Issue ID: MSV-3708."
}
],
"id": "CVE-2025-20703",
"lastModified": "2025-09-03T16:07:38.867",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-09-01T06:15:33.357",
"references": [
{
"source": "security@mediatek.com",
"tags": [
"Vendor Advisory"
],
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025"
}
],
"sourceIdentifier": "security@mediatek.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "security@mediatek.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-09-01 06:15
Modified
2025-09-03 16:07
Severity ?
Summary
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01516959; Issue ID: MSV-3502.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@mediatek.com | https://corp.mediatek.com/product-security-bulletin/September-2025 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mediatek | nr17 | - | |
| mediatek | nr17r | - | |
| mediatek | mt6813 | - | |
| mediatek | mt6835 | - | |
| mediatek | mt6835t | - | |
| mediatek | mt6878 | - | |
| mediatek | mt6878m | - | |
| mediatek | mt6897 | - | |
| mediatek | mt6899 | - | |
| mediatek | mt6991 | - | |
| mediatek | mt8676 | - | |
| mediatek | mt8678 | - | |
| mediatek | mt8792 | - | |
| mediatek | mt8863 | - | |
| mediatek | mt8873 | - | |
| mediatek | mt8883 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mediatek:nr17:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66F8874B-DBF1-4A67-8ADF-4654AB56B6A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr17r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BC63582A-F9A5-4450-A263-CE1FD4B4F3AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*",
"matchCriteriaId": "19A63103-C708-48EC-B44D-5E465A6B79C5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6835t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7FE7DBA-479C-402B-8485-9D14E70F25EB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*",
"matchCriteriaId": "855A8046-34ED-4891-ACE5-76AB10AC8D53",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6878m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "483B6FB0-D683-4F3C-BA5B-6C9852179854",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2A7D8055-F4B6-41EE-A078-11D56285AB66",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBBB30DF-E963-4940-B742-F6801F68C3FC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EE302F6F-170E-4350-A8F4-65BE0C50CB78",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152A5F3D-8004-4649-BDB1-E6F0798AF1CB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*",
"matchCriteriaId": "336FC69E-E89F-4642-B6B9-8009D9A2BD52",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77E0D738-F0B9-468F-8A10-204F498320BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D6DD525F-7050-42BD-829D-1121698B8009",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23DD8281-FEB4-4E23-8DDA-680FF895F12E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01516959; Issue ID: MSV-3502."
}
],
"id": "CVE-2025-20704",
"lastModified": "2025-09-03T16:07:22.770",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-09-01T06:15:34.630",
"references": [
{
"source": "security@mediatek.com",
"tags": [
"Vendor Advisory"
],
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025"
}
],
"sourceIdentifier": "security@mediatek.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "security@mediatek.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-08-04 02:15
Modified
2025-08-18 15:42
Severity ?
Summary
In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915681; Issue ID: MSV-3795.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@mediatek.com | https://corp.mediatek.com/product-security-bulletin/August-2025 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| android | 14.0 | ||
| android | 15.0 | ||
| mediatek | mt2718 | - | |
| mediatek | mt6761 | - | |
| mediatek | mt6765 | - | |
| mediatek | mt6768 | - | |
| mediatek | mt6853 | - | |
| mediatek | mt6855 | - | |
| mediatek | mt6877 | - | |
| mediatek | mt6878 | - | |
| mediatek | mt6879 | - | |
| mediatek | mt6883 | - | |
| mediatek | mt6885 | - | |
| mediatek | mt6889 | - | |
| mediatek | mt6893 | - | |
| mediatek | mt6897 | - | |
| mediatek | mt6989 | - | |
| mediatek | mt6991 | - | |
| mediatek | mt8186 | - | |
| mediatek | mt8196 | - | |
| mediatek | mt8391 | - | |
| mediatek | mt8678 | - | |
| mediatek | mt8775 | - | |
| mediatek | mt8786 | - | |
| mediatek | mt8788e | - | |
| mediatek | mt8792 | - | |
| mediatek | mt8796 | - | |
| mediatek | mt8873 | - | |
| mediatek | mt8883 | - | |
| mediatek | mt8893 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5506327-7DDF-4E88-9EA8-10B8E32F848B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F726F486-A86F-4215-AD93-7A07A071844A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*",
"matchCriteriaId": "43E779F6-F0A0-4153-9A1D-B715C3A2F80E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*",
"matchCriteriaId": "06CD97E1-8A76-48B4-9780-9698EF5A960F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*",
"matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*",
"matchCriteriaId": "855A8046-34ED-4891-ACE5-76AB10AC8D53",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704BE5CE-AE08-4432-A8B0-4C8BD62148AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15E2EC3F-9FB3-488B-B1C1-2793A416C755",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD64413C-C774-4C4F-9551-89E1AA9469EE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B787DC3-8E5A-4968-B20B-37B6257FAAE2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "213B5C7F-D965-4312-9CDF-4F06FA77D401",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2A7D8055-F4B6-41EE-A078-11D56285AB66",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AD7DE6B2-66D9-4A3E-B15F-D56505559255",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBBB30DF-E963-4940-B742-F6801F68C3FC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E4932D34-06F4-49D7-81FB-772A82E8A5B5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*",
"matchCriteriaId": "43B2824E-8D18-4DD7-91E7-41578B2FCD6C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152A5F3D-8004-4649-BDB1-E6F0798AF1CB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DE5FB550-7264-4879-BAF9-6798949113AF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CEDF887A-1862-4336-ABFC-371838E1D029",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*",
"matchCriteriaId": "336FC69E-E89F-4642-B6B9-8009D9A2BD52",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DE933AD9-3A6F-421B-8AB3-C45F8DEA9548",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D6DD525F-7050-42BD-829D-1121698B8009",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23DD8281-FEB4-4E23-8DDA-680FF895F12E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFAADB1-C2B2-47A6-BB66-761B964E7DFB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915681; Issue ID: MSV-3795."
},
{
"lang": "es",
"value": "En Power HAL, existe una posible escritura fuera de los l\u00edmites debido a la falta de una comprobaci\u00f3n de los l\u00edmites. Esto podr\u00eda provocar una escalada local de privilegios si un agente malicioso ya ha obtenido el privilegio de System. No se requiere la interacci\u00f3n del usuario para la explotaci\u00f3n. ID de parche: ALPS09915681; ID de problema: MSV-3795."
}
],
"id": "CVE-2025-20697",
"lastModified": "2025-08-18T15:42:08.480",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.8,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-08-04T02:15:26.863",
"references": [
{
"source": "security@mediatek.com",
"tags": [
"Vendor Advisory"
],
"url": "https://corp.mediatek.com/product-security-bulletin/August-2025"
}
],
"sourceIdentifier": "security@mediatek.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "security@mediatek.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-08-04 02:15
Modified
2025-08-18 15:41
Severity ?
Summary
In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915400; Issue ID: MSV-3793.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@mediatek.com | https://corp.mediatek.com/product-security-bulletin/August-2025 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| android | 13.0 | ||
| android | 14.0 | ||
| android | 15.0 | ||
| mediatek | mt2718 | - | |
| mediatek | mt6739 | - | |
| mediatek | mt6761 | - | |
| mediatek | mt6765 | - | |
| mediatek | mt6768 | - | |
| mediatek | mt6781 | - | |
| mediatek | mt6789 | - | |
| mediatek | mt6833 | - | |
| mediatek | mt6835 | - | |
| mediatek | mt6853 | - | |
| mediatek | mt6855 | - | |
| mediatek | mt6877 | - | |
| mediatek | mt6878 | - | |
| mediatek | mt6879 | - | |
| mediatek | mt6883 | - | |
| mediatek | mt6885 | - | |
| mediatek | mt6886 | - | |
| mediatek | mt6889 | - | |
| mediatek | mt6893 | - | |
| mediatek | mt6895 | - | |
| mediatek | mt6897 | - | |
| mediatek | mt6899 | - | |
| mediatek | mt6983 | - | |
| mediatek | mt6985 | - | |
| mediatek | mt6989 | - | |
| mediatek | mt6991 | - | |
| mediatek | mt8186 | - | |
| mediatek | mt8196 | - | |
| mediatek | mt8391 | - | |
| mediatek | mt8676 | - | |
| mediatek | mt8678 | - | |
| mediatek | mt8775 | - | |
| mediatek | mt8786 | - | |
| mediatek | mt8788e | - | |
| mediatek | mt8792 | - | |
| mediatek | mt8796 | - | |
| mediatek | mt8873 | - | |
| mediatek | mt8883 | - | |
| mediatek | mt8893 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*",
"matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5506327-7DDF-4E88-9EA8-10B8E32F848B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7FA8A390-9F52-4CF3-9B45-936CE3E2B828",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F726F486-A86F-4215-AD93-7A07A071844A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*",
"matchCriteriaId": "43E779F6-F0A0-4153-9A1D-B715C3A2F80E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*",
"matchCriteriaId": "06CD97E1-8A76-48B4-9780-9698EF5A960F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C4EEE021-6B2A-47A0-AC6B-55525A40D718",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8B9B0D82-82C1-4A77-A016-329B99C45F49",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9814939B-F05E-4870-90C0-7C0F6BAAEB39",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*",
"matchCriteriaId": "19A63103-C708-48EC-B44D-5E465A6B79C5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*",
"matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*",
"matchCriteriaId": "855A8046-34ED-4891-ACE5-76AB10AC8D53",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704BE5CE-AE08-4432-A8B0-4C8BD62148AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15E2EC3F-9FB3-488B-B1C1-2793A416C755",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD64413C-C774-4C4F-9551-89E1AA9469EE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF3E2B84-DAFE-4E11-B23B-026F719475F5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B787DC3-8E5A-4968-B20B-37B6257FAAE2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "213B5C7F-D965-4312-9CDF-4F06FA77D401",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0CA45C9-7BFE-4C93-B2AF-B86501F763AB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2A7D8055-F4B6-41EE-A078-11D56285AB66",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AD7DE6B2-66D9-4A3E-B15F-D56505559255",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBBB30DF-E963-4940-B742-F6801F68C3FC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E4932D34-06F4-49D7-81FB-772A82E8A5B5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*",
"matchCriteriaId": "43B2824E-8D18-4DD7-91E7-41578B2FCD6C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EE302F6F-170E-4350-A8F4-65BE0C50CB78",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152A5F3D-8004-4649-BDB1-E6F0798AF1CB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DE5FB550-7264-4879-BAF9-6798949113AF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CEDF887A-1862-4336-ABFC-371838E1D029",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*",
"matchCriteriaId": "336FC69E-E89F-4642-B6B9-8009D9A2BD52",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DE933AD9-3A6F-421B-8AB3-C45F8DEA9548",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D6DD525F-7050-42BD-829D-1121698B8009",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23DD8281-FEB4-4E23-8DDA-680FF895F12E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFAADB1-C2B2-47A6-BB66-761B964E7DFB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915400; Issue ID: MSV-3793."
},
{
"lang": "es",
"value": "En Power HAL, existe una posible escritura fuera de los l\u00edmites debido a la falta de una comprobaci\u00f3n de los l\u00edmites. Esto podr\u00eda provocar una escalada local de privilegios si un agente malicioso ya ha obtenido privilegios de System. No se requiere la interacci\u00f3n del usuario para la explotaci\u00f3n. ID de parche: ALPS09915400; ID de problema: MSV-3793."
}
],
"id": "CVE-2025-20698",
"lastModified": "2025-08-18T15:41:58.840",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.8,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-08-04T02:15:27.010",
"references": [
{
"source": "security@mediatek.com",
"tags": [
"Vendor Advisory"
],
"url": "https://corp.mediatek.com/product-security-bulletin/August-2025"
}
],
"sourceIdentifier": "security@mediatek.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "security@mediatek.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-09-01 06:15
Modified
2025-09-03 16:06
Severity ?
Summary
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01123853; Issue ID: MSV-4131.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@mediatek.com | https://corp.mediatek.com/product-security-bulletin/September-2025 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mediatek:nr15:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E30A2D2E-6A72-4070-A471-EEE75F7D07F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr16:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B763B71-F913-45B4-B91E-D7F0670C4315",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr17:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66F8874B-DBF1-4A67-8ADF-4654AB56B6A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:mediatek:nr17r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BC63582A-F9A5-4450-A263-CE1FD4B4F3AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C2A1118-B5F7-4EF5-B329-0887B5F3430E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B7122918-8C44-4F24-82E4-B8448247FC83",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9814939B-F05E-4870-90C0-7C0F6BAAEB39",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6833p:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CB690F5A-9367-45D3-A53E-80BF60053630",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*",
"matchCriteriaId": "19A63103-C708-48EC-B44D-5E465A6B79C5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6835t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7FE7DBA-479C-402B-8485-9D14E70F25EB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*",
"matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "328DA6BE-1303-4646-89B7-2EC8DC444532",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6855t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "083F6134-FF26-4F1B-9B77-971D342AF774",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*",
"matchCriteriaId": "80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6875t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F883C6D3-1724-4553-9EFC-3D204FF3CAA3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EFA54AA1-4E3A-44F8-A222-31C60F8F81DA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877tt:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5D4D6885-E18C-477F-8B6D-B9E84D9535E2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*",
"matchCriteriaId": "855A8046-34ED-4891-ACE5-76AB10AC8D53",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6878m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "483B6FB0-D683-4F3C-BA5B-6C9852179854",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*",
"matchCriteriaId": "704BE5CE-AE08-4432-A8B0-4C8BD62148AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68CF4A7A-3136-4C4C-A795-81323896BE11",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15E2EC3F-9FB3-488B-B1C1-2793A416C755",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD64413C-C774-4C4F-9551-89E1AA9469EE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF3E2B84-DAFE-4E11-B23B-026F719475F5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B787DC3-8E5A-4968-B20B-37B6257FAAE2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*",
"matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D8E91CA4-CA5B-40D1-9A96-2B875104BCF4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "213B5C7F-D965-4312-9CDF-4F06FA77D401",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0CA45C9-7BFE-4C93-B2AF-B86501F763AB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6895tt:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2141B30A-C56F-4831-8FCD-4758DF97AD18",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33DEF766-EAF1-4E36-BB7C-43069B26507A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2A7D8055-F4B6-41EE-A078-11D56285AB66",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA9131F6-F167-4FD7-8FBF-B372CBBCF46F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6980d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2758122C-4D11-4D34-9B72-3905F3A28448",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6983t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7D6430E-840D-447F-892E-EA4FD7F69BAF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6985t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DEBB2AE0-F6CD-4CAF-BBF2-09C5C20B9910",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AD7DE6B2-66D9-4A3E-B15F-D56505559255",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6989t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6309AE48-7266-435C-B906-50960F643FC8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1A76806D-A4E3-466A-90CB-E9FFE478E7A0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBBB30DF-E963-4940-B742-F6801F68C3FC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152F6606-FA23-4530-AA07-419866B74CB3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*",
"matchCriteriaId": "03E6123A-7603-4EAB-AFFB-229E8A040709",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EE302F6F-170E-4350-A8F4-65BE0C50CB78",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152A5F3D-8004-4649-BDB1-E6F0798AF1CB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D09F23D-D023-4A60-B426-61251FDD8A5A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9CD2C3EC-B62D-4616-964F-FDBE5B14A449",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1BB05B1D-77C9-4E42-91AD-9F087413DC20",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*",
"matchCriteriaId": "336FC69E-E89F-4642-B6B9-8009D9A2BD52",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78D4E9E1-B044-41EC-BE98-22DC0E5E9010",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B469BF4-5961-42E9-814B-1BE06D182E45",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*",
"matchCriteriaId": "637CAAD2-DCC0-4F81-B781-5D0536844CA8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77E0D738-F0B9-468F-8A10-204F498320BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D6DD525F-7050-42BD-829D-1121698B8009",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23DD8281-FEB4-4E23-8DDA-680FF895F12E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFAADB1-C2B2-47A6-BB66-761B964E7DFB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01123853; Issue ID: MSV-4131."
}
],
"id": "CVE-2025-20708",
"lastModified": "2025-09-03T16:06:40.560",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-09-01T06:15:35.287",
"references": [
{
"source": "security@mediatek.com",
"tags": [
"Vendor Advisory"
],
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025"
}
],
"sourceIdentifier": "security@mediatek.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "security@mediatek.com",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-09-01 06:15
Modified
2025-09-03 16:06
Severity ?
Summary
In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09924201; Issue ID: MSV-3820.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security@mediatek.com | https://corp.mediatek.com/product-security-bulletin/September-2025 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| android | 13.0 | ||
| android | 14.0 | ||
| android | 15.0 | ||
| mediatek | mt2718 | - | |
| mediatek | mt6853 | - | |
| mediatek | mt6877 | - | |
| mediatek | mt6893 | - | |
| mediatek | mt6899 | - | |
| mediatek | mt6991 | - | |
| mediatek | mt8196 | - | |
| mediatek | mt8676 | - | |
| mediatek | mt8678 | - | |
| mediatek | mt8775 | - | |
| mediatek | mt8786 | - | |
| mediatek | mt8788e | - | |
| mediatek | mt8791t | - | |
| mediatek | mt8792 | - | |
| mediatek | mt8796 | - | |
| mediatek | mt8883 | - | |
| mediatek | mt8893 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*",
"matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5506327-7DDF-4E88-9EA8-10B8E32F848B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*",
"matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "213B5C7F-D965-4312-9CDF-4F06FA77D401",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBBB30DF-E963-4940-B742-F6801F68C3FC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EE302F6F-170E-4350-A8F4-65BE0C50CB78",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152A5F3D-8004-4649-BDB1-E6F0798AF1CB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DE5FB550-7264-4879-BAF9-6798949113AF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CEDF887A-1862-4336-ABFC-371838E1D029",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1BB05B1D-77C9-4E42-91AD-9F087413DC20",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*",
"matchCriteriaId": "336FC69E-E89F-4642-B6B9-8009D9A2BD52",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DE933AD9-3A6F-421B-8AB3-C45F8DEA9548",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*",
"matchCriteriaId": "23DD8281-FEB4-4E23-8DDA-680FF895F12E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFAADB1-C2B2-47A6-BB66-761B964E7DFB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09924201; Issue ID: MSV-3820."
}
],
"id": "CVE-2025-20707",
"lastModified": "2025-09-03T16:06:46.333",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.8,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-09-01T06:15:35.123",
"references": [
{
"source": "security@mediatek.com",
"tags": [
"Vendor Advisory"
],
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025"
}
],
"sourceIdentifier": "security@mediatek.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "security@mediatek.com",
"type": "Secondary"
}
]
}