MediaTek WLAN Driver CVE-2025-20714

Exploitation requires the attacker to ALREADY hold System privilege on the device, as stated verbatim in the description ('if a malicious actor has already obtained the System privilege'); it then abuses the wlan AP driver's incorrect bounds check to perform an out-of-bounds stack write. No user interaction is needed (UI:N) and the vector is local only (AV:L) - there is no network-reachable path. The dominant limiting factor is this high pre-existing privilege bar, which makes the flaw a privilege-escalation step available only to an already-privileged local attacker, not a remote or unauthenticated entry point. Applies to devices running the affected MediaTek software development kit, including OpenWrt 19.07.0 and 21.02.0 builds that incorporate the vulnerable driver.

This is a genuine but conditional local privilege-escalation flaw, not a top-tier emergency. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the attack vector is strictly local and EPSS rates exploitation probability at just 0.14% (3rd percentile), indicating no observed exploitation interest. The vulnerability is not listed in CISA KEV and no public exploit code was identified, so all exploitation signals point to low near-term real-world risk. A critical caveat: the CVSS vector encodes PR:L (low privilege), yet the description explicitly states escalation is only possible 'if a malicious actor has already obtained the System privilege' - these conflict, and System privilege is effectively the highest privilege on the platform, which would argue for PR:H. This discrepancy means the practical prerequisite (already holding System privilege) is far more restrictive than PR:L suggests, further lowering real-world priority - verify the intended privilege prerequisite with MediaTek. There is no SSVC decision data provided. Net: a legitimately exploitable stack overflow for local EoP, but gated behind an already-privileged attacker and showing no exploitation momentum.

An attacker who has already compromised a device and obtained System-level privilege invokes the vulnerable wlan AP driver path with crafted input that fails the incorrect bounds check, triggering an out-of-bounds stack write. By controlling the overflow, the attacker corrupts kernel memory to elevate from System privilege to full kernel/root-level control without any user interaction. No public proof-of-concept exists, and the local-only vector with a high pre-existing privilege requirement makes this a post-compromise escalation step rather than an initial-access technique.