MediaTek WLAN Driver CVE-2025-20710

The attacker must be within wireless (adjacent/proximal) range of a device running the vulnerable MediaTek WLAN AP driver - consistent with CVSS AV:A - so this is not internet-wide remotely exploitable; physical radio proximity is the primary limiting factor. Within that range, no authentication (PR:N) and no user interaction (UI:N) are required, so default-configured access points operating as an AP with the affected MediaTek WLAN driver are exploitable by crafted wireless traffic that triggers the integer overflow. The flaw is specific to the AP (access-point) driver path, so devices deployed purely as Wi-Fi clients/stations may not expose the vulnerable code path.

Signals are moderate-to-serious but not critical in practice. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:H = 8.8) indicates an adjacent-network, low-complexity, unauthenticated flaw requiring no user interaction and yielding full compromise of the affected component - a genuinely dangerous profile for anything in Wi-Fi radio range. The key limiter is AV:A (adjacent), not AV:N: the attacker must be within wireless proximity of the AP, which sharply narrows mass/remote exploitation versus an internet-facing bug. Exploitation-probability signals are low and consistent with each other: EPSS is 0.30% (20th percentile), there is no CISA KEV listing, and no public exploit code is referenced - i.e., no public exploit identified at time of analysis. No SSVC decision data was provided in the input, so automatable/exploitation/technical-impact cannot be evaluated against that framework. Net: this is a technically high-impact memory-corruption EoP (integer overflow → OOB write, CWE-190) that merits patching on affected MediaTek Wi-Fi AP deployments, but current real-world exploitation risk is low and physically gated by adjacency rather than widespread remote mass-exploitation. No conflicting signals were found between the description and the CVSS vector; both agree on adjacent, no-auth, no-UI exploitation.

An attacker within Wi-Fi radio range of a device running the vulnerable MediaTek WLAN AP driver sends specially crafted wireless frames that trigger an integer overflow in the AP driver, producing an out-of-bounds write. With no authentication and no user interaction required, the memory corruption is leveraged to escalate privileges within the driver/kernel context. No public proof-of-concept or exploit code was identified in the provided data.