MediaTek WLAN Driver
CVE-2025-20713
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local System privilege on device
-
DeliveryCraft malformed input to wlan AP driver
-
ExploitTrigger stack out-of-bounds write via faulty bounds check
-
ExecutionCorrupt kernel memory for code execution
-
ImpactEscalate to full kernel privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a device running the vulnerable MediaTek wlan AP driver (MediaTek SDK, and OpenWrt 19.07.0/21.02.0 builds per the CPEs) AND the attacker must already hold the System privilege level, per the description; the malformed input then triggers an out-of-bounds stack write through the driver's incorrect bounds check. No user interaction is needed (UI:N). The primary limiting factor is the steep prerequisite - a prior compromise to System privilege - which makes this a second-stage escalation rather than an initial-access vector, substantially narrowing realistic exploitation to already-compromised devices. |
| Impact | This is a genuine but lower-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local attack needing some existing privilege, and the CWE-121 stack-based buffer overflow in the MediaTek wlan AP driver yields full C/I/A via kernel memory corruption. However, the description materially raises the bar beyond the CVSS score: it states the attacker must 'already have obtained the System privilege,' which is effectively high privilege (PR:H) rather than the PR:L encoded in the vector - this is a conflicting signal and should be verified with MediaTek, since it means the flaw is a second-stage escalation (System → kernel) rather than a low-barrier LPE. Exploitation signals are weak: EPSS is only 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit is identified. Net assessment: a real and patchable kernel-level bug, but not an urgent fire-drill - prioritize it in normal patch cycles for affected MediaTek/OpenWrt WLAN devices rather than as emergency remediation, because an attacker already needs System privilege to leverage it. |
| Exploit ScenarioDerived | An attacker who has already compromised a device to the System privilege level (e.g., via a prior exploit or a malicious app with elevated rights) interacts locally with the vulnerable MediaTek wlan AP driver, supplying crafted input that fails the incorrect bounds check. The resulting out-of-bounds stack write corrupts kernel memory to escalate from System to full kernel/root-equivalent control with no user interaction required. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Local privilege escalation in the MediaTek wlan AP driver lets an attacker who already holds System privilege trigger an out-of-bounds stack write through an incorrect bounds check, escalating to full confidentiality, integrity, and availability impact (CVSS 3.1 7.8, assessed vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) without any user interaction. Affected deployments include the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 builds that embed the vulnerable MediaTek wireless driver. No public exploit code or confirmed active exploitation has been identified (EPSS 0.14%, 3rd percentile), which is consistent with a second-stage escalation that requires a prior System-level compromise rather than an initial-access vector.
RemediationAI
Apply the fix described in MediaTek's October 2025 product security bulletin (https://corp.mediatek.com/product-security-bulletin/October-2025, patch ID WCNCR00432661, issue MSV-3904); the bulletin is the authoritative source because the input data does not publish an exact patched release version, so confirm the corrected driver build with MediaTek or your device OEM before assuming coverage. For OpenWrt, migrate off the unsupported 19.07.0 and 21.02.0 releases to a currently maintained OpenWrt release or rebuild the image with the updated MediaTek wireless driver package, then reflash affected units. Where patching must be deferred, note that exploitation already requires the attacker to hold System privilege, so the highest-value controls are privilege-reduction and containment: remove or tightly limit accounts and services operating at that privilege level, restrict local shell and debug interfaces, and enable kernel hardening such as module-loading restrictions or mandatory access control (SELinux/AppArmor) to blunt an escalation from System to kernel context - the trade-off being operational friction and possible breakage of legitimate management tooling. Unloading or blacklisting the vulnerable wlan driver on devices that do not need AP functionality removes the attack surface entirely, but it disables Wi-Fi AP operation on those units, so it is only practical for wired-only or non-wireless deployments. Because no public exploit code is known at this time, detection should focus on anomalous privileged driver activity and unexpected privilege transitions rather than known exploit signatures.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a stack-based buffer overflow (CWE-121) in the MediaTek wlan AP driver, where a malformed input bypasses an incorrect bounds check and causes an out-of-bounds write into stack memory. Because the driver operates in a privileged context, corrupting its stack can be leveraged to redirect execution and escalate beyond the caller's privilege level. The attack is local (AV:L) with no user interaction (UI:N), and the description explicitly requires the attacker to have already obtained the System privilege, which is why our independent assessment raises the privilege requirement to PR:H while NVD scored it PR:L; that prerequisite is the dominant limiting factor and reframes this as post-compromise, second-stage escalation instead of an entry vector. The CPE data shows the vulnerable code ships both in MediaTek's proprietary software development kit (all versions listed as in scope) and in OpenWrt 19.07.0 and 21.02.0 firmware images, meaning the same driver weakness is reachable in router/AP firmware built on the SDK.
Know when Openwrt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local driver interaction (AV:L); description requires pre-existing System privilege so PR:H not PR:L; reliable OOB write gives AC:L; kernel corruption yields full C/I/A.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
DescriptionCVE.org
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432661; Issue ID: MSV-3904.
Executive ViewAI
MediaTek wireless AP driver in MediaTek SDK and OpenWrt 19.07.0/21.02.0 contains a high-severity local privilege escalation flaw (CVE-2025-20713) that allows an attacker with existing System privileges to gain full control of affected devices. No vendor-released patch is currently available, and no public exploit has been identified. Leadership should prioritize inventory and mitigation because these platforms often underpin wireless infrastructure, though exploitation requires a prior high-privilege foothold.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting local System-level access, disabling or removing the vulnerable MediaTek wlan AP driver where possible, isolating affected access points, monitoring for privilege escalation, and applying least-privilege principles.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Affected Products (CPE)CVE.org
In wlan service, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. Rated high severity (CVS
An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used o
cgi_handle_request in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1
Remote privilege escalation in Android WLAN AP driver via packet injection.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
Remote code execution in OpenWrt's mDNS daemon (versions before 24.10.6 and 25.12.1) allows unauthenticated attackers to
GitHub PoC
Exploit-DB