Nr15
CVE-2024-20069
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (mediatek) · only source for this CVE.
CVSS VectorVendor: mediatek
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01286330; Issue ID: MSV-1430.
AnalysisAI
In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-757. In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01286330; Issue ID: MSV-1430. Affected products include: Mediatek Nr15.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. Rated critical severity (CVSS
In Modem, there is a possible memory corruption due to a missing bounds check. Rated critical severity (CVSS 9.8), this
In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check. Rated critical severity (CV
In Modem 2G RR, there is a possible out of bounds write due to a missing bounds check. Rated critical severity (CVSS 9.8
In Modem 2G/3G CC, there is a possible out of bounds write due to a missing bounds check. Rated critical severity (CVSS
In modem protocol, there is a possible out of bounds write due to a missing bounds check. Rated high severity (CVSS 8.8)
In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. Rated high severity (CVSS 7
In Modem IMS Stack, there is a possible system crash due to a missing bounds check. Rated high severity (CVSS 7.5), this
In Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. Rated high severity (CVSS 7.
In Modem, there is a possible system crash due to an uncaught exception. Rated high severity (CVSS 7.5), this vulnerabil
In Modem, there is a possible information disclosure due to incorrect error handling. Rated high severity (CVSS 7.5), th
In modem EMM, there is a possible system crash due to improper input validation. Rated high severity (CVSS 7.5), this vu
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today