CVE-2024-20017

CVSS 9.8 CRITICALEPSS 46.3%CWE-20 CWE-787

In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

MediaTek, Inc. · MT6890, MT7915, MT7916, MT7981, MT7986

PoCs públicas encontradas — 1

githubgithub.com/mellow-hype/cve-2024-20017★ 140

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html https://blog.sonicwall.com/en-us/2024/09/critical-exploit-in-mediatek-wi-fi-chipsets-zero-click-vulnerability-cve-2024-20017-threatens-routers-and-smartphones/https://corp.mediatek.com/product-security-bulletin/March-2024 https://news.ycombinator.com/item?id=41605680