MediaTek WLAN Driver
CVE-2025-20717
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain System privilege on device
-
DeliveryInvoke vulnerable wlan AP driver interface
-
ExploitTrigger stack out-of-bounds write via bad bounds check
-
ExecutionCorrupt kernel memory
-
ImpactEscalate to kernel-level control
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a device running the affected MediaTek wlan AP driver (MediaTek Software Development Kit, or OpenWrt 19.07.0 / 21.02.0 on MediaTek-based hardware) AND the attacker must ALREADY hold System privilege on that device before triggering the bug. No user interaction is required (UI:N). The attack is reachable only through the local wlan AP driver interface - it is not remotely exploitable over the network. The pre-existing System-privilege requirement is the dominant limiting factor: this is a second-stage escalation primitive, not an initial-access vulnerability. |
| Impact | This is a genuine but conditional local privilege-escalation flaw, not a remote emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local attacker with low complexity and no user interaction achieving full confidentiality/integrity/availability impact. The critical qualifier is in the description: exploitation requires the attacker to 'have already obtained the System privilege.' This is a strong limiting factor - System is already a highly privileged context on Android/embedded platforms, so this bug escalates System to kernel/driver level rather than granting an unprivileged user a foothold. There is a tension worth flagging: MediaTek rated PR:L, but a prerequisite of pre-existing System privilege is more honestly PR:H, which would lower the real-world score. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. No SSVC data was supplied. Overall this is a defense-in-depth kernel-hardening fix that matters for device integrity but requires a significant pre-existing compromise, placing it below internet-facing criticals in patch priority. |
| Exploit ScenarioDerived | An attacker who has already compromised a MediaTek-based access point or router to the point of holding System privilege (e.g., via a prior app/service compromise) invokes the vulnerable wlan AP driver path with crafted input that fails the incorrect bounds check, triggering a stack-based out-of-bounds write. This corrupts kernel/driver memory to escalate from System to full kernel-level control without any user interaction. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Local privilege escalation in the MediaTek WLAN AP driver (shipped via the MediaTek Software Development Kit and integrated into OpenWrt 19.07.0 and 21.02.0 builds on MediaTek-based hardware) allows an attacker who already holds System privilege on the device to trigger a stack-based out-of-bounds write and gain elevated code execution. Exploitation requires local access to the affected driver interface and a pre-existing System-privilege foothold, so this is a second-stage escalation primitive rather than an initial-access or remote vulnerability; user interaction is not required. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published a fix (Patch ID WCNCR00419946) in its October 2025 product security bulletin.
RemediationAI
The primary fix is the vendor-supplied driver update identified as Patch ID WCNCR00419946 in MediaTek's October 2025 product security bulletin (https://corp.mediatek.com/product-security-bulletin/October-2025); apply it through your silicon/module vendor or download the corresponding patched SDK drop and rebuild firmware, then publish updated images for OpenWrt 19.07.0 and 21.02.0 devices running MediaTek wireless hardware - since OpenWrt 19.07.x and 21.02.x are end-of-life branches, the practical route is to rebuild on a supported OpenWrt release once the fixed driver/firmware blob lands, as no in-place package update path is guaranteed. Because the bug is only reachable from an already System-privileged local context, the most effective compensating controls are to prevent untrusted code from ever reaching that privilege level: do not grant System/root to non-administrative users or to container/jail workloads on the AP, and enforce that custom applications run as unprivileged users rather than the Wi-Fi driver's context. Where AP functionality is not required, disabling the wireless AP mode or the affected MediaTek wireless interface removes the attack surface entirely, at the cost of losing Wi-Fi service on that radio; restricting local management access (disabling unused debug interfaces and serial/console logins, tightening SSH/HTTP admin exposure) reduces the chance an attacker can acquire the System foothold the exploit depends on, though it does not remove the underlying driver bug. Note that KEV status is not confirmed for this CVE and no public exploit code was identified at time of analysis, so remediation can be scheduled in a normal patch cycle rather than treated as an emergency, but the driver update should still be tracked to completion because the flaw is a memory-corruption primitive whose weaponization potential increases once a pre-existing System-privilege vector is found.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow in the MediaTek wlan AP (access point) driver: a length or index value reaching a driver routine is not validated against the size of a destination buffer on the stack, so a crafted local request causes an out-of-bounds write past the buffer boundary. The affected component is the wireless AP driver used with MediaTek Wi-Fi silicon, distributed both as part of the MediaTek Software Development Kit (CPE cpe:2.3:a:mediatek:software_development_kit) and as the driver/firmware stack bundled into OpenWrt 19.07.0 and 21.02.0 images for MediaTek-based access points and routers (CPE cpe:2.3:o:openwrt:openwrt:19.07.0 and cpe:2.3:o:openwrt:openwrt:21.02.0). Because the vulnerable code sits in the kernel-side AP driver, a successful write can corrupt adjacent kernel stack data and be pivoted into code execution at the driver's privilege level, which is why the impact is scored High across confidentiality, integrity and availability. The vendor bulletin issued under Patch ID WCNCR00419946 and issue ID MSV-3582 references the AP driver configuration paths; the publicly published CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates the privilege prerequisite as Low, whereas our independent assessment re-scores it as High (PR:H) because the bug is only reachable once the caller already has System privilege on the device, making the practical exploitation surface considerably narrower than the vendor score implies.
Know when Openwrt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local driver interface (AV:L), no user interaction (UI:N); PR:H because the description requires the attacker to already hold System privilege, and full C/I/A impact on kernel/driver.
Primary rating from Vendor (mediatek).
CVSS VectorVendor: mediatek
DescriptionCVE.org
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00419946; Issue ID: MSV-3582.
Executive ViewAI
A privilege-escalation flaw in the MediaTek WLAN AP driver affects network devices running OpenWrt 19.07.0 and 21.02.0 on MediaTek-based hardware, allowing someone who already holds System-level access on the device to escalate to elevated code execution. Because this is a second-stage escalation rather than a remote entry point, the direct risk to the organization is concentrated in already-compromised or insider-accessible network hardware, but it materially weakens the containment barrier that leadership relies on to limit the blast radius of any initial intrusion. With no patched OpenWrt build identified for these widely deployed releases, affected devices should be treated as unmitigated and prioritized for replacement or compensating controls.
No vendor-released patched build was identified for OpenWrt 19.07.0 and 21.02.0 deployments at time of analysis; interim mitigations are to eliminate or tightly restrict pre-existing System-privilege access on affected devices, disable unused local management and driver interfaces, segment affected hardware onto isolated management networks, and monitor for local privilege changes, pending availability of the MediaTek fix identified as WCNCR00419946 in the October 2025 product security bulletin.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Affected Products (CPE)CVE.org
In wlan service, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. Rated high severity (CVS
An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used o
cgi_handle_request in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1
Remote privilege escalation in Android WLAN AP driver via packet injection.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
Remote code execution in OpenWrt's mDNS daemon (versions before 24.10.6 and 25.12.1) allows unauthenticated attackers to
GitHub PoC
Exploit-DB