EUVD-2026-33541
GHSA-mfvp-3qw7-v5gw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessMove within Wi-Fi range of AP
-
DeliveryAssociate as low-privileged client
-
ExploitSend crafted 802.11 frames
-
ExecutionTrigger heap buffer overflow in wlan AP driver
-
PersistExecute arbitrary code on AP
-
ImpactPivot into internal network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be within radio/adjacent-network range (CVSS AV:A) of an AP using one of the listed MediaTek chipsets (MT7615/7915/7916/7981/7986/7990/7992/7993/MT6890) operating in AP mode with the vulnerable wlan AP driver loaded, and must hold low-level privileges sufficient to associate with the AP (PR:L) - typically an authenticated or guest Wi-Fi client, or any station on an open SSID. No user interaction is required (UI:N) and complexity is low (AC:L). Limiting factors: the bug is not reachable over the internet (no AV:N), it requires the device to be actively operating as an AP rather than purely as a client, and it requires the attacker to be able to associate or be in L2 proximity, which constrains exploitation to physically nearby attackers or compromised neighboring stations. |
| Impact | The CVSS 8.0 (High) vector AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H signals that exploitation requires adjacent network access (same Wi-Fi/L2 segment), low complexity, and only low privileges - the attacker must be associated to or within radio range of the affected AP. No EPSS score or SSVC decision was provided in the input, and there is no public exploit identified at time of analysis, nor is this in CISA KEV, so this should be treated as a high-severity but not actively exploited issue. The realistic risk is meaningful for exposed Wi-Fi infrastructure (cafes, hotels, enterprise guest networks) where attackers can readily reach the adjacent attack surface, but it is not internet-exploitable. Key data missing: no EPSS, no SSVC, no POC indicator, and the MediaTek bulletin does not enumerate exact patched firmware versions in the provided references - defenders should verify firmware status with their device OEM. |
| Exploit ScenarioDerived | An attacker within Wi-Fi range of a vulnerable MediaTek-based AP associates as a low-privileged client (e.g., using guest network credentials or an open SSID) and transmits crafted 802.11 management or data frames that overflow a heap buffer in the AP driver, achieving code execution on the AP itself. With control of the access point, the attacker pivots into the internal network, intercepts and modifies wireless traffic, or persists firmware-level implants. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 01, 2026
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user execution to corrupt memory and achieve remote code execution without user interaction. The flaw affects multiple MediaTek Wi-Fi chipsets commonly embedded in routers and access points (MT7615, MT7915, MT7916, MT7981, MT7986, MT7990, MT7992, MT7993, MT6890). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Apply the patch referenced by MediaTek as Patch ID WCNCR00480138 (Issue ID MSV-6295) per the June 2026 MediaTek Product Security Bulletin (https://corp.mediatek.com/product-security-bulletin/June-2026); because MediaTek delivers fixes through downstream OEMs, contact your AP/router vendor (e.g., ASUS, Netgear, TP-Link, Ubiquiti, Zyxel, and OpenWrt-based device vendors using these chipsets) for the corresponding firmware update - patch available per vendor advisory, but no single fix version is published upstream. If patched firmware is not yet available, compensating controls include restricting Wi-Fi access via WPA3 or strong WPA2-Enterprise authentication to limit who can become an adjacent attacker, disabling guest/open SSIDs on affected APs, isolating affected AP management interfaces on a dedicated VLAN, and reducing radio range or relocating APs away from public space - trade-offs include reduced coverage and inconvenience for legitimate guest users, and none of these controls fully eliminate the risk from an authorized but malicious station.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the wireless LAN access point (AP) driver shipped with MediaTek chipsets, which implements 802.11 frame processing on the AP side. CWE-122 (Heap-Based Buffer Overflow) indicates the driver fails to validate the size of attacker-influenced data before copying it into a heap allocation, corrupting adjacent heap metadata or function pointers. Because the driver runs in privileged firmware/kernel context on the chipset, memory corruption is leveraged for arbitrary code execution. The CPE entry (cpe:2.3:a:mediatek,_inc.:mediatek_chipset) is generic, but the EUVD enumerates the specific chipset models - MT7615/7915/7916/7981/7986/7990/7992/7993 and MT6890 - which are widely deployed in consumer and enterprise Wi-Fi 5/6/7 routers, mesh systems, and OEM AP platforms.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (MediaTek) · only source for this CVE.
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In wlan AP driver, there is a possible memory corruption due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00480138; Issue ID: MSV-6295.
Executive ViewAI
A critical vulnerability in MediaTek Wi-Fi chipsets threatens the integrity of network access points and routers deployed across enterprise environments, allowing attackers on adjacent networks to execute arbitrary code without user interaction. Organizations relying on affected MediaTek chipsets for wireless infrastructure-including service providers managing customer networks-face potential compromise of network perimeter security, guest network isolation, and downstream system access. With no vendor patch currently available, immediate defensive action is required to isolate and monitor affected infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to Wi-Fi management interfaces via firewall rules; segment wireless infrastructure from critical systems; monitor for unexpected access point behavior; disable remote management protocols on affected devices if operationally feasible; maintain firmware update monitoring for MediaTek and device OEM advisories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to
Exploit-DB