MediaTek WLAN Driver CVE-2025-20719

Exploitation requires the device to be running the vulnerable MediaTek WLAN AP driver (MediaTek SDK; confirmed affected on OpenWrt 19.07.0 and 21.02.0 builds using it) and operating in access-point mode so it processes the malicious wireless frames. The attacker must be within wireless radio range (AV:A, proximal/adjacent) of the target AP - this proximity requirement is the primary limiting factor and precludes remote internet-based attack. No authentication (PR:N) and no user interaction (UI:N) are required once in range, and no special non-default configuration beyond normal AP operation is implied by the description.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes an adjacent-network, low-complexity, unauthenticated, no-user-interaction stack-based out-of-bounds write (CWE-121) in the MediaTek WLAN AP driver yielding full confidentiality, integrity and availability impact - a serious profile for an attacker already within radio/WiFi range. However, the exploitation signals are modest and non-escalating: EPSS is only 0.26% (16th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, indicating no evidenced or probable widespread exploitation despite the high base score. The adjacency requirement (AV:A, not AV:N) is the key risk-limiting factor - the attacker must be within wireless proximity of the vulnerable access point rather than exploiting across the internet, which bounds this to localized/targeted scenarios. No SSVC decision record was supplied in the input, so automatable/exploitation-status framework values cannot be cited. Net assessment: a genuinely high-severity memory-corruption EoP and a real patching priority for affected MediaTek-based AP/router firmware, but currently lower operational urgency than the 8.8 alone implies because exploitation is proximity-bound and no public PoC or active exploitation is evidenced.

An attacker within WiFi range of a MediaTek-chipset access point transmits specially crafted wireless frames whose length fields defeat the driver's faulty bounds check, triggering a stack-based out-of-bounds write in the AP driver. Because exploitation needs no authentication and no user interaction (AV:A/PR:N/UI:N), a proximal attacker can corrupt driver memory to escalate privilege on the device. No public exploit code has been identified at time of analysis, so this remains a credible but not-yet-demonstrated proximal attack.