Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-20017

In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.

Published

2024-03-04T03:15:06.970

Last Modified

2025-05-05T17:48:05.470

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses

Type: Secondary
CWE-20
CWE-787

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mediatek	software_development_kit	≤ 7.4.0.1	Yes
Hardware	mediatek	mt7622	-	No
Hardware	mediatek	mt7915	-	No
Application	mediatek	software_development_kit	≤ 7.6.7.0	Yes
Hardware	mediatek	mt7916	-	No
Hardware	mediatek	mt7981	-	No
Hardware	mediatek	mt7986	-	No
Operating System	openwrt	openwrt	19.07.0	Yes
Operating System	openwrt	openwrt	21.02.0	Yes
Hardware	mediatek	mt6890	-	No

References

https://corp.mediatek.com/product-security-bulletin/March-2024 Vendor Advisory ([email protected])
https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html Exploit, Technical Description, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://blog.sonicwall.com/en-us/2024/09/critical-exploit-in-mediatek-wi-fi-chipsets-zero-click-vulnerability-cve-2024-20017-threatens-routers-and-smartphones/ Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://corp.mediatek.com/product-security-bulletin/March-2024 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://news.ycombinator.com/item?id=41605680 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)