What is the CVSS score of CVE-2025-20720?

CVE-2025-20720 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2025-20720?

Within 24 hours, inventory all wireless access points and SoftAP devices running the MediaTek WLAN AP driver, prioritizing OpenWrt 19.07.0 and 21.02.0 builds; disable AP/SoftAP mode where it is not operationally required, and otherwise limit RF exposure by controlling physical access and segmenting affected wireless traffic. Within 7 days, check vendor and OpenWrt advisories for a fixed driver or firmware, apply any vendor-released patch if it becomes available after testing, and implement interim controls such as disabling vulnerable AP code paths, isolating affected access-point networks, and monitoring for anomalous 802.11 activity. Within 30 days, replace or upgrade affected MediaTek-based access points to supported hardware or firmware that does not rely on the vulnerable driver, re-scan the estate for remaining OpenWrt 19.07.0 and 21.02.0 instances, and document compensating controls until a vendor patch is available.

MediaTek WLAN AP Driver CVE-2025-20720

HIGH

Heap-based Buffer Overflow (CWE-122)

2025-10-14 security@mediatek.com

Privilege Escalation Buffer Overflow Heap Overflow Mediatek Openwrt Software Development Kit

8.8

CVSS 3.1 · Vendor: mediatek

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain wireless adjacency to target AP
Delivery

Send crafted 802.11 frames to AP driver
Exploit

Trigger heap out-of-bounds write (bad bounds check)
Execution

Corrupt driver/kernel memory
Impact

Escalate privilege and compromise device

Vulnerability Assessment

Weakness	CWE CWE-122 ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the attacker to be within wireless/radio adjacency of a device running the vulnerable MediaTek wlan AP driver (the access-point/SoftAP code path must be active), consistent with AV:A. Per the CVSS vector (PR:N/UI:N), it is unauthenticated and needs no user interaction and no pre-existing privileges - the attacker simply sends crafted 802.11 frames that defeat the incorrect bounds check. Limiting factors: the attack is not routable over the internet (physical/RF proximity needed), the device must be operating as an AP using the affected MediaTek SDK driver, and only MediaTek SDK plus OpenWrt 19.07.0/21.02.0 builds incorporating the vulnerable driver are affected; devices not acting as an AP or running patched firmware (Patch ID WCNCR00418954) are not exposed.
Impact	Signals are mixed and point to a serious-but-not-emergency priority. The CVSS 3.1 vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8 High) describes a low-complexity, unauthenticated attack over an adjacent/wireless vector with full confidentiality, integrity, and availability impact - serious for an exposed wireless access point. However, the exploitation-probability signals are modest: EPSS is only 0.26% (16th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data, so there is no evidence of active or imminent widespread exploitation. The AV:A (adjacent) constraint is the key limiter - an attacker must be within wireless/radio range rather than exploiting over the open internet, which caps mass-scanning exploitation and favors localized or targeted use. There is no direct conflict between the CVSS vector and the description: both agree on remote proximal/adjacent access with no privileges or user interaction. Net assessment: a genuinely impactful heap out-of-bounds write warranting prompt patching on Wi-Fi infrastructure, but the low EPSS, absence of KEV, and adjacency requirement argue against treating it as a drop-everything internet-facing emergency.
Exploit ScenarioDerived	An attacker within wireless range of a vulnerable MediaTek-based access point (e.g., an OpenWrt-based router) sends specially crafted 802.11 management or data frames to the AP driver. An incorrect bounds check causes a heap out-of-bounds write (CWE-122), corrupting kernel/driver memory to escalate privilege and potentially execute code with no authentication or user interaction. No public proof-of-concept was identified at the time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

A heap-based out-of-bounds write in the MediaTek WLAN AP driver lets an attacker within wireless/radio range corrupt kernel memory by sending crafted 802.11 frames that defeat an incorrect bounds check, yielding full confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N) with no authentication, no user interaction and no prior privileges required. Exposure is limited to devices whose access-point/SoftAP code path runs the vulnerable MediaTek SDK driver, including OpenWrt 19.07.0 and 21.02.0 builds that bundle it, and the flaw is not routable over the internet. Per the provided data there is no public exploit identified at time of analysis and no CISA KEV listing, and the low EPSS score (0.26%, 16th percentile) reflects the RF-proximity precondition rather than a lack of severity.

RemediationAI

Patch status is: patch available per vendor advisory - MediaTek has issued Patch ID WCNCR00418954 (Issue ID MSV-3569) and the fix is documented in the October 2025 MediaTek product security bulletin at https://corp.mediatek.com/product-security-bulletin/October-2025; no tagged downstream version string is confirmed in the available data, so OpenWrt 19.07.0 and 21.02.0 operators should obtain the vendor driver fix directly from MediaTek or from a distribution rebuild that incorporates it rather than assuming an existing release is clean. Where the patched driver cannot be deployed immediately, the most effective compensating control is to disable the access-point/SoftAP interface on affected hardware and keep the radio in station/client mode, which removes the vulnerable code path at the cost of losing AP functionality; additionally, treat the device's wireless coverage area as the trust boundary and reduce RF spill outside controlled physical space, since the attack requires radio adjacency and cannot be reached from the internet. Because exploitation is unauthenticated and needs no user interaction (PR:N/UI:N per the vector), there is no credential or user-education mitigation that meaningfully reduces exposure - WPA/WPA2/WPA3 encryption on a vulnerable AP does not block a crafted-frame attack, so network-layer hardening should be treated as supplementary only, with firmware replacement, not configuration, as the durable fix.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-122 (heap-based buffer overflow): the driver's 802.11 frame handling in the AP/SoftAP path performs an incorrect bounds check before writing attacker-influenced data into a heap buffer, producing an out-of-bounds write. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates the trigger travels over an adjacent-network channel (AV:A) - i.e. radio adjacency to a device with the AP interface active - with low attack complexity and no authentication or user interaction, and the resulting memory corruption stays within the same security scope while delivering high confidentiality, integrity and availability impact. CPE data identifies the affected surface as MediaTek's software development kit (cpe:2.3:a:mediatek:software_development_kit) plus OpenWrt 19.07.0 (cpe:2.3:o:openwrt:openwrt:19.07.0) and 21.02.0 (cpe:2.3:o:openwrt:openwrt:21.02.0) releases that incorporate the vulnerable driver; the vendor tracking identifiers are Patch ID WCNCR00418954 and Issue ID MSV-3569. OpenWrt is affected as a downstream consumer of the vendor driver rather than as the originator of the defect, so the fix must come from MediaTek and be re-integrated by the distribution.

Know when Openwrt gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mediatek) PRIMARY 8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Wireless/adjacent reach gives AV:A; no auth or interaction for a crafted-frame heap write gives PR:N/UI:N/AC:L; driver/kernel compromise yields C:H/I:H/A:H, scope unchanged.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mediatek).

CVSS VectorVendor: mediatek

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418954; Issue ID: MSV-3569.

Executive ViewAI

Why It Matters

MediaTek WLAN AP driver, as bundled in some OpenWrt 19.07.0 and 21.02.0 access-point/SoftAP builds, contains a high-severity memory-safety flaw that could allow a nearby unauthenticated wireless attacker to fully compromise an affected access point, disrupting Wi-Fi service and exposing or altering network traffic. Organizations running these devices for wireless access should treat this as a proximity-limited but serious risk, particularly where AP/SoftAP mode is enabled. Leadership should care because no vendor-released patch identified at time of analysis, meaning remediation may depend on interim mitigations, device replacement, or future vendor updates.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include disabling AP/SoftAP mode on affected MediaTek-based OpenWrt 19.07.0/21.02.0 devices where feasible, restricting wireless/RF proximity, segmenting affected access-point traffic, and monitoring vendor advisories for a future patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 84% exploitable

Prevalence

High

MediaTek Wi-Fi SDK and OpenWrt power very large numbers of consumer and embedded routers/APs

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Controlled

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.