MediaTek WLAN Driver CVE-2025-20716

Exploitation requires the attacker to ALREADY hold the System privilege on the affected MediaTek-based device, from which the flaw escalates further into the kernel; it is local-only (AV:L) with no user interaction needed. The specific trigger is the wlan AP driver code path containing the incorrect bounds check, reached through the MediaTek SDK WiFi access-point driver (as shipped in MediaTek SoC firmware and OpenWrt 19.07.0 / 21.02.0 builds). The dominant limiting factor is the high privilege precondition - an attacker lacking System-level access cannot reach this bug - which, combined with the local-only vector and no public exploit, substantially narrows realistic exploitation to post-compromise privilege chaining on devices running the affected driver.

This is a CWE-787 out-of-bounds write in the MediaTek wlan AP driver enabling local privilege escalation. The input CVSS vector (AV:L/AC:L/PR:L/UI:N) yields 7.8 (High), but there is a direct conflict between the vector and the description: the description explicitly states exploitation requires an actor who 'has already obtained the System privilege,' which implies high pre-existing privilege (PR:H), not the low privilege (PR:L) encoded in the vector - this discrepancy should be verified with MediaTek. Exploitation signals point AWAY from urgent, widespread risk: EPSS is only 0.14% (3rd percentile), the CVE is NOT in CISA KEV, and no public exploit code has been identified. This is a local-only (AV:L) escalation that presupposes the attacker already holds System-level access, so it functions as a privilege-chaining / sandbox-escape primitive rather than an initial-access vulnerability. No SSVC decision data was provided in the input. Net assessment: a genuinely high-severity memory-corruption bug worth patching on affected MediaTek-based devices, but NOT an emergency - the low EPSS, absence of KEV/POC, local attack vector, and the high privilege precondition all indicate low near-term real-world exploitation likelihood.

An attacker who has already compromised a device to the System privilege level (e.g., via a separate app or earlier exploit) invokes the vulnerable wlan AP driver path with crafted input that fails an incorrect bounds check. The resulting out-of-bounds write corrupts kernel memory to escalate from System to full kernel/root control, requiring no user interaction. No public proof-of-concept exploit has been identified at time of analysis, so weaponization effort would fall on the attacker.