In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416937; Issue ID: MSV-3445.
The error results from incorrect bounds checking in the wlan AP driver. An attacker with regular user privileges can cause data to be written outside the designated memory area (CWE-787 — out of bounds write). Exploiting the vulnerability does not require any interaction from another user. The manufacturer's patch identifier is WCNCR00416937, problem number MSV-3445.
An attacker can obtain elevated system privileges on the vulnerable device, which may consequently lead to full system takeover (privilege escalation).
Apply patches available from the manufacturer according to references (Patch ID: WCNCR00416937). Detailed update instructions available in MediaTek security bulletin from July 2025: https://corp.mediatek.com/product-security-bulletin/July-2025
Devices with MediaTek MT7915, MT7916, MT7615, MT7981 chipsets and OpenWrt on these platforms — specific firmware versions indicated in manufacturer's references (MediaTek security bulletin, July 2025)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMediatek Mt6890
HWMediatekwszystkie wersjeMediatek Mt7615
HWMediatekwszystkie wersjeMediatek Mt7622
HWMediatekwszystkie wersjeMediatek Mt7663
HWMediatekwszystkie wersjeMediatek Mt7915
HWMediatekwszystkie wersjeMediatek Mt7916
HWMediatekwszystkie wersjeMediatek Mt7981
HWMediatekwszystkie wersjeMediatek Mt7986
HWMediatekwszystkie wersjeMediatek Software Development Kit
APPMediatek≤ 7.6.7.2Openwrt
OSOpenwrt19.07.021.02.0
Related vulnerabilities
Stack-based Buffer Overflow w mdns daemon OpenWrt — możliwy RCE
Stack-based Buffer Overflow w demonie mdns OpenWrt — przepełnienie stosu przez PTR query
Out-of-bounds write w sterowniku WLAN AP MediaTek – privilege escalation
Out of bounds write w sterowniku wlan AP — eskalacja uprawnień na układach MediaTek
Out-of-bounds write w sterowniku WLAN AP MediaTek — privilege escalation