MediaTek WLAN Driver CVE-2025-20712

Requires the attacker to be within wireless (adjacent/proximal) radio range of a device running the affected MediaTek WLAN access-point driver - this is the primary limiting factor, as the flaw is not exploitable over the general internet (AV:A). The vulnerable code path is the AP-mode driver's handling of 802.11 frames where an incorrect bounds check permits an out-of-bounds heap write; the device must therefore be operating as a WiFi access point using the affected MediaTek SDK/driver (as shipped in MediaTek SDK and OpenWrt 21.02.0 / 23.05 per CPE). No authentication (PR:N) and no user interaction (UI:N) are needed against default AP configurations, so the only meaningful constraints are physical wireless proximity and the device running the affected driver build.

This is a genuine high-priority issue within its deployment niche, though several signals temper the raw 8.8 score. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms an adjacent-network, low-complexity, unauthenticated attack requiring no user interaction and yielding full compromise (C:H/I:H/A:H) - a strong profile for an attacker already within WiFi range. CWE-122 (heap-based buffer overflow) via an out-of-bounds write from an incorrect bounds check in the AP-side driver is consistent with code-execution/privilege-escalation potential. However, the EPSS score is low (0.30%, 20th percentile), and there is no CISA KEV listing and no public exploit identified, indicating no evidence of widespread or active exploitation at this time. The decisive limiting factor is AV:A: exploitation is not internet-remote - the attacker must be within wireless radio proximity of the vulnerable access point, which constrains mass exploitation and favors localized or targeted scenarios. No SSVC decision data was provided in the input. Net assessment: a serious flaw for exposed WiFi infrastructure that should be patched, but the adjacent-only vector plus low EPSS make it a lower immediate threat than an equivalent network-facing bug.

An attacker positioned within WiFi radio range of a device running the vulnerable MediaTek WLAN access-point driver sends crafted 802.11 wireless frames that fail the driver's bounds check, triggering a heap out-of-bounds write. No authentication or user interaction is required, and successful exploitation can escalate privileges on the target device. No public proof-of-concept or exploit code has been identified at the time of analysis.