MediaTek WLAN Driver CVE-2025-20709

Exploitation requires the attacker to be within wireless radio range (adjacent network, AV:A) of a device running the vulnerable MediaTek WLAN AP driver - i.e., an operating access point reachable over the air. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any in-range attacker can transmit the malicious WLAN frames that trigger the out-of-bounds write. The principal limiting factor is physical/RF proximity: the flaw is not exploitable from the internet or across routed networks, only by an adversary within wireless reception distance of the affected AP. Affected deployments include MediaTek SDK-based firmware and OpenWrt 19.07.0 / 21.02.0 builds using this driver.

This is a genuine elevated-priority issue for affected wireless deployments, though not a drop-everything emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N) is internally consistent with the description: adjacent (proximal/radio-range) attack vector, low complexity, no privileges, and no user interaction, yielding high confidentiality, integrity and availability impact (8.8). The critical constraint is AV:A - the attacker must be within wireless/radio range of the affected AP, which bounds this to local-RF adversaries rather than internet-wide scanning. Signals partially conflict on urgency: EPSS is low at 0.31% (22nd percentile) and the CVE is NOT in CISA KEV with no public POC identified, suggesting no widespread or automated exploitation to date; the low EPSS is consistent with the adjacency requirement limiting mass exploitation. However, the memory-corruption class (CWE-120 out-of-bounds write in a kernel/driver context) with no-interaction, no-auth preconditions is exactly the profile that attracts weaponization against high-value targets, so the low EPSS should be read as 'not yet exploited' rather than 'low technical severity.' No SSVC decision data was supplied in the input, so automatable/exploitation/technical-impact framing cannot be independently stated. Net: prioritize patching for exposed APs, but physical/RF proximity meaningfully reduces real-world attack surface versus a pure AV:N network flaw.

An attacker within wireless range of a vulnerable MediaTek-based access point (e.g., sitting in range of a consumer or OpenWrt-based router) transmits specially crafted WLAN frames that defeat the driver's faulty bounds check, triggering an out-of-bounds write in the AP driver. Because no authentication or user interaction is required, the attacker corrupts memory and escalates privileges on the device, potentially gaining control of the AP. No public exploit code has been identified at time of analysis.