MediaTek WLAN Driver CVE-2025-20718

Exploitation requires the attacker to already hold local, low-privileged ('User') execution on the affected device and to reach the wlan AP driver code path that performs the faulty bounds check; no user interaction and no network access are involved. Limiting factors: the attacker must first obtain local code execution (there is no remote entry point per AV:L), the device must run an affected MediaTek SDK WLAN AP driver build (confirmed for OpenWrt 19.07.0 and 21.02.0 and the MediaTek SDK), and unpatched firmware lacking patch WCNCR00419945 is required. This is not a default-configuration remote flaw; risk is highest on devices that run untrusted or multi-tenant local code.

Signals are internally consistent and point to a genuine but non-urgent local privilege-escalation issue rather than a remotely exploitable emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have local, low-privileged code execution on the device - matching the description's 'local escalation of privilege with User execution privileges needed' - with full C:H/I:H/A:H impact yielding kernel/root-level compromise. EPSS is very low (0.17%, 5th percentile), there is no CISA KEV listing, and no public exploit is referenced, so there is no evidence of active or widespread exploitation. The high 7.8 base score is driven entirely by impact, not accessibility; this is a classic high-CVSS/low-immediate-real-risk pattern for a local driver bug. It remains a real priority for devices where untrusted or multi-tenant local code can run (e.g., a compromised unprivileged process seeking kernel access on an OpenWrt-based AP), but it is not a mass-exploitation threat. No conflicting signals were identified; the main gap is the absence of any detailed vendor technical write-up beyond the bulletin summary.

An attacker who has already achieved low-privileged code execution on a MediaTek-based wireless access point (for example via a compromised unprivileged service on an OpenWrt router) invokes the vulnerable wlan AP driver path and supplies input that fails the incorrect bounds check. The resulting stack-based out-of-bounds write corrupts kernel memory, allowing escalation from the user-level context to full kernel/root privileges. No public proof-of-concept is referenced, and no user interaction is required.