Openwrt
Monthly
Authenticated delegated LuCI sessions that hold the luci-app-advanced-reboot read ACL can execute arbitrary commands as root on affected OpenWrt routers, because that read ACL grants rpcd file.exec permission for the general shell interpreter /bin/sh and passes caller-controlled parameters to it. Only builds that actually ship this /bin/sh exec grant prior to version 1.1.2-6 are vulnerable; the vendor explicitly states the checked openwrt-24.10 and openwrt-23.05 branches do not carry the grant and are not affected by this chain. Exploitation requires a valid low-privilege delegated rpcd/LuCI session (CVSS vector PR:L, no unauthenticated path), and no public exploit code was identified at time of analysis; the issue is fixed in 1.1.2-6.
Persistent root command execution in luci-app-adblock-fast prior to 1.2.4-2 on OpenWrt: an authenticated LuCI user who has been granted the component's write ACL can abuse the luci.adblock-fast.setCronEntry RPC by embedding carriage-return or line-feed characters in the entry argument. Because the value is serialized into /etc/crontabs/root as if it were a single line, the delegated user can create an additional physical cron entry that runs as UID 0 when cron executes. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) is directionally sound but materially gated by the mandatory pre-existing luci-app-adblock-fast write ACL and by cron actually running; exploitation is not demonstrated for unauthenticated users or users lacking that ACL. No public exploit identified at time of analysis, and the vendor fix is 1.2.4-2.
OS command injection in OpenWrt's luci-app-dockerman grants any authenticated user holding only the read ACL full root-level code execution on the affected router. The vulnerable run_ttyd handler in the ucode docker_rpc.uc backend constructs a shell command from attacker-controlled request fields (id, cmd, uid) and passes them unsanitized to system() within the rpcd root context, reachable via a simple HTTP POST to /ubus. Only LuCI master and openwrt-25.12 snapshots after the JS-to-ucode backend conversion are affected; upstream patch commits exist but no released patched snapshot version was confirmed as of the advisory, and no public exploit is identified at time of analysis.
Unauthenticated path traversal in OpenWrt's luci-app-bmx7 package exposes arbitrary files on affected routers via the bmx7-info CGI endpoint. Attackers can supply directory traversal sequences in the CGI query string to escape the configured runtimeDir and read any file readable by the CGI process, including credentials, network configuration, or cryptographic keys stored on the device. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated network attack vector (CVSS 4.0: 8.7) presents a low barrier to opportunistic exploitation against exposed management interfaces.
Stored cross-site scripting in OpenWrt's default odhcpd server (all releases prior to 25.12.5) lets a network-adjacent DHCP client inject forged lease records that execute as HTML/JavaScript in a router administrator's browser. The client-supplied DHCPv6 FQDN option 39 (and DHCPv4 option 12) hostname is written unescaped into /tmp/odhcpd.leases, enabling newline injection of attacker-controlled fields that LuCI's Active DHCPv6 Leases page renders via unsafe dom.append. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; it is fixed in 25.12.5.
Ban-list poisoning in OpenWrt's luci-app-banip (banIP) before 1.8.10 lets an unauthenticated remote attacker steer the automated IP-blocking engine at an arbitrary victim. Because the awk-based log monitor grabs the first IPv4 address it finds on a log line regardless of field position, an attacker can embed a spoofed IP inside an attacker-controlled field such as a login username; banIP then bans that injected address while the real attacker's source IP is never blocked. Reported by VulnCheck with a vendor patch available; no public exploit code or active exploitation is identified at time of analysis.
Stored cross-site scripting in OpenWrt's LuCI web interface lets an adjacent-network attacker inject executable HTML/JavaScript by supplying a malicious DHCPv6 Client FQDN hostname, which the DHCP lease status tables render without proper output encoding. When an administrator views the DHCP lease page, the payload executes in their authenticated browser session, enabling router admin-panel compromise. Rated CVSS 4.0 9.4 (Critical) by the vendor; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in OpenWrt's luci-app-upnp lets an unauthenticated LAN client persist a JavaScript payload that executes in the router administrator's browser. By supplying malicious HTML in the NewPortMappingDescription field of a UPnP IGD AddPortMapping SOAP request, an attacker gets miniupnpd to store the value and luci-app-upnp to render it unencoded on the UPnP and Status pages. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High).
Privilege escalation to root in OpenWrt's luci-app-samba4 (LuCI web interface) lets authenticated delegated users invoke the root-owned Samba daemon with attacker-controlled arguments. The package's 'read' ACL improperly grants file.exec permission on /usr/sbin/smbd, so a low-privileged operator can launch smbd with global options like 'message command' and achieve arbitrary command execution as root when SMB messages are processed. Reported by VulnCheck with a GHSA advisory published; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Root-level command injection in OpenWrt's luci-app-travelmate/travelmate (confirmed in 2.4.5-r3, sink still present in 2.4.6-1) lets an rpcd/LuCI session holding only the luci-app-travelmate write ACL escalate to arbitrary command execution as root. The LuCI UI limits the auto-login script picker to /etc/travelmate/*.login, but that is a frontend-only check: the root-run backend reads the raw UCI 'script' and 'script_args' values, so an attacker sets script to /bin/sh with controlled arguments to run commands as root when the captive-portal auto-login branch fires. Reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Root command injection in OpenWrt's LuCI web interface (luci-proto-openvpn through 0.11.1) lets an authenticated user with OpenVPN protocol configuration access run arbitrary commands as root. The flaw lives in the generateKey ubus method, where the cl_meta parameter is passed unescaped into a popen() shell call. No public exploit has been identified at time of analysis, but a vendor advisory (GHSA-pm9w-522m-8rrh) and fix commit exist, and the CVSS 4.0 score of 8.7 reflects full confidentiality, integrity, and availability impact on the affected device.
Authenticated root command injection in the OpenWrt LuCI community Tailscale app (luci-app-tailscale-community) lets a logged-in web UI user run arbitrary OS commands as root through the tailscale.do_login RPC method. Because the user-supplied loginserver and loginserver_authkey values are placed inside a double-quoted shell string, $() and backtick substitutions are evaluated by the outer shell, turning configuration input into command execution. Reported by VulnCheck with a published GHSA advisory; no public exploit identified at time of analysis and the issue is not in CISA KEV.
A stored cross-site scripting (XSS) vulnerability exists in the OpenWrt LuCI web interface where malicious JavaScript code embedded in Wi-Fi network names (SSIDs) can execute when users open the wireless scan modal. The vulnerability affects OpenWrt versions newer than 23.05/22.03 up to 24.10.5 and 25.12.0, allowing attackers within wireless range to compromise users who scan for available networks. No active exploitation has been reported (not in KEV), and with an EPSS score not provided, the real-world exploitation risk appears limited despite the high CVSS score of 8.6.
OpenWrt versions prior to 24.10.6 allow local attackers with limited privileges to inject a malicious PATH environment variable into hotplug scripts due to improper filtering in the hotplug_call function, enabling execution of arbitrary binaries with elevated privileges. The vulnerability stems from a strcmp/strncmp logic error that fails to properly exclude the PATH variable when executing scripts in /etc/hotplug.d, resulting in local privilege escalation. No patch is currently available.
Remote code execution in OpenWrt's mDNS daemon (versions before 24.10.6 and 25.12.1) allows unauthenticated attackers to overflow a 46-byte stack buffer by sending malformed IPv6 PTR queries over multicast DNS on UDP port 5353. The vulnerability stems from insufficient validation of domain name length before copying to a fixed-size buffer, enabling arbitrary code execution on affected embedded devices. No patch is currently available.
Remote code execution in OpenWrt mdns daemon (versions before 24.10.6 and 25.12.1) allows unauthenticated attackers to crash the service or execute arbitrary code by sending specially crafted DNS PTR queries to UDP port 5353, exploiting a stack buffer overflow in the parse_question function. The vulnerability occurs when domain names are expanded and copied without bounds checking, with non-printable characters inflating the payload beyond the fixed 256-byte buffer. No patch is currently available for affected embedded device deployments.
OpenWrt and its Software Development Kit contain an out-of-bounds write vulnerability in the WLAN access point firmware caused by improper bounds checking, enabling adjacent network attackers to achieve privilege escalation without user interaction or special privileges. The vulnerability carries high severity with complete impact across confidentiality, integrity, and availability, though no patch is currently available.
OpenWRT and related SDKs are vulnerable to a heap buffer overflow in the WLAN component that allows adjacent network attackers to execute privilege escalation without user interaction or special permissions. The out-of-bounds write condition enables attackers on the same network segment to gain elevated system privileges. No patch is currently available for this vulnerability.
Unauthenticated flooding of crafted DHCPv6 RENEW messages can repeatedly crash odhcpd, the DHCPv6/DHCPv4/router-advertisement server shipped and enabled by default on OpenWrt, denying IPv6 address configuration to clients on the local link. An attacker who is network-adjacent (AV:A, PR:N, UI:N) must first complete two legitimate SOLICIT/REQUEST exchanges to obtain bindings, then send a single RENEW containing multiple IA_NA options that triggers an unsigned size_t underflow and lets attacker-controlled data be serialized past the 512-byte stack buffer pdbuf; the stack canary terminates the daemon and procd respawns it, so sustained packets cause recurring DHCPv6 outages. Impact is availability-only (C:N/I:N/A:H) and the observed configuration does not establish code execution; no public exploit identified at time of analysis, and the issue is fixed in OpenWrt 25.12.5.
Heap-based buffer overflow in luci-lib-px5g's native ASN.1 encoding routine allows a locally authenticated attacker to write one byte beyond a heap-allocated buffer during certificate signing, with a high availability impact and limited confidentiality and integrity exposure. The flaw is triggered specifically when signing with a 2040-bit RSA key via the exported Lua interface create_selfsigned(), where a DER length encoding miscalculation causes an allocation of 259 bytes for a payload requiring 260. Remote exploitability is not confirmed - it depends entirely on whether the embedding application exposes this interface externally. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stored cross-site scripting in luci-app-adblock-fast before 1.2.4-4 allows a lower-privileged LuCI user to inject malicious JavaScript into the blocklist name field, which executes in an administrator's browser under the LuCI origin when the AdBlock Fast status page is viewed. Because the payload runs within the LuCI same-origin context, a successful attack could enable session hijacking, unauthorized router reconfiguration, or privilege escalation from low-privileged user to effective admin control. No public exploit is identified at time of analysis; a vendor patch is available via the GitHub Security Advisory GHSA-q335-4c83-c88h.
Stored cross-site scripting in luci-app-https-dns-proxy allows a highly privileged but potentially lower-trust authenticated LuCI user to persist a malicious JavaScript payload via the resolver_url parameter, which then silently executes in any administrator's browser when the HTTPS DNS Proxy status page is loaded. All currently tracked LuCI versions appear affected per EUVD listing (luci 0 <*). No public exploit code or CISA KEV listing is confirmed at time of analysis, though the stored nature of this XSS makes it more dangerous than a reflected variant because no additional attacker interaction is needed after initial injection.
Path traversal in OpenWrt's cgi-io cgi-download handler (prior to 25.12.5) allows an authenticated administrator to read arbitrary root-readable files - including /etc/shadow - by exploiting a TOCTOU-style authorization flaw where ACL checks occur before path canonicalization. The rpcd session.c ACL matcher uses fnmatch() without FNM_PATHNAME, meaning a wildcard-prefixed ACL entry (e.g., /etc/config/*) can be defeated by appending ../ sequences that pass the ACL check but resolve to an out-of-scope file when open() is called. No public exploit identified at time of analysis; vendor-released patch is available in v25.12.5.
Integer underflow in the OpenWrt Emergency Access Daemon crashes the daemon when any unauthenticated attacker on the local network sends a single crafted UDP packet to it. Affected are all OpenWrt versions prior to v25.12.5. The CVSS adjacent-network vector (AV:A) constrains the attack surface to local or adjacent network segments, but within that context exploitation requires no credentials and no user interaction - a single malformed packet suffices. No public exploit code or CISA KEV listing has been identified at time of analysis; the patch is confirmed available in v25.12.5.
A security vulnerability in versions (CVSS 4.9). Remediation should follow standard vulnerability management procedures.
Device unique identifiers in the preloader of Openwrt, Android, Yocto, RDK-B, and Zephyr can be read by attackers with physical access due to a logic error, leading to local information disclosure without requiring additional privileges or user interaction. This vulnerability affects multiple embedded and IoT platforms where the preloader executes before operating system initialization. No patch is currently available for this issue.
An uncaught exception in WLAN AP/STA firmware for NBIoT SDK, OpenWrt, and related development kits enables adjacent network attackers to trigger a denial of service condition that renders the system unresponsive without requiring authentication or user interaction. The vulnerability affects multiple wireless products and has no available patch at this time, presenting a medium-severity risk in networked environments.
In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In preloader, there is a possible escalation of privilege due to an insecure default value. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds read in the MediaTek wlan AP driver allows a locally authenticated low-privileged user to read memory beyond an intended buffer boundary and disclose potentially sensitive information from devices running the vulnerable driver, including MediaTek Software Development Kit builds and OpenWrt 19.07.0 and 21.02.0 systems. Exploitation requires existing local access to the device (CVSS 3.1 AV:L/PR:L/UI:N, base score 5.5) and no user interaction, and the impact is confined to confidentiality only, with no integrity or availability effect and no code execution. There is no public exploit code identified and no confirmed active exploitation at time of analysis, and the EPSS score is low (0.14%, 3rd percentile); MediaTek has published a fix (patch ID WCNCR00418894, issue MSV-3475) in its October 2025 product security bulletin.
An out-of-bounds read caused by an integer overflow (CWE-190) in the MediaTek GNSS driver can disclose memory contents on affected devices, but only to an attacker who has already obtained the Android System privilege. The flaw is local-only (AV:L), requires no user interaction, and yields confidentiality impact only, with no integrity or availability effect. No public exploit code has been identified at time of analysis, EPSS is negligible (0.09%), and the vendor has released a fix (Patch ID ALPS09920036) in the October 2025 MediaTek product security bulletin, so the practical risk is low despite the MEDIUM 5.5 base score.
A heap-based out-of-bounds write in the MediaTek WLAN AP driver lets an attacker within wireless/radio range corrupt kernel memory by sending crafted 802.11 frames that defeat an incorrect bounds check, yielding full confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N) with no authentication, no user interaction and no prior privileges required. Exposure is limited to devices whose access-point/SoftAP code path runs the vulnerable MediaTek SDK driver, including OpenWrt 19.07.0 and 21.02.0 builds that bundle it, and the flaw is not routable over the internet. Per the provided data there is no public exploit identified at time of analysis and no CISA KEV listing, and the low EPSS score (0.26%, 16th percentile) reflects the RF-proximity precondition rather than a lack of severity.
A stack-based out-of-bounds write (CWE-121) in the MediaTek WLAN AP driver lets an attacker who is within wireless radio range of a vulnerable access point corrupt memory without authenticating and without any user interaction, yielding a full compromise of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected builds include the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 images that ship the vulnerable driver, and exploitation requires the device to be operating in access-point mode so it parses the malicious wireless frames. At time of analysis EPSS is only 0.26% (16th percentile) and no public exploit code has been identified, so the practical risk is dominated by the adjacency requirement - an attacker must be physically close enough to the AP to transmit crafted frames.
An out-of-bounds write (stack-based buffer overflow, CWE-121) in the MediaTek WLAN AP driver lets a local attacker with ordinary 'User' execution privileges corrupt adjacent stack memory and escalate to higher privileges in the driver's context. Exploitation requires pre-existing local code execution on a device running an affected MediaTek SDK WLAN AP driver build - confirmed in CPE data for the MediaTek software development kit and OpenWrt 19.07.0 and 21.02.0 - with no user interaction and no network reachability involved (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). Exploit maturity is low: no public exploit code was identified at time of analysis and EPSS is only 0.17% (5th percentile), so this is a post-compromise privilege-escalation primitive rather than an urgent remotely exploitable flaw.
Local privilege escalation in the MediaTek WLAN AP driver (shipped via the MediaTek Software Development Kit and integrated into OpenWrt 19.07.0 and 21.02.0 builds on MediaTek-based hardware) allows an attacker who already holds System privilege on the device to trigger a stack-based out-of-bounds write and gain elevated code execution. Exploitation requires local access to the affected driver interface and a pre-existing System-privilege foothold, so this is a second-stage escalation primitive rather than an initial-access or remote vulnerability; user interaction is not required. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published a fix (Patch ID WCNCR00419946) in its October 2025 product security bulletin.
Local privilege escalation in the MediaTek wlan AP driver lets an attacker who already holds System privilege on an affected MediaTek-based device trigger an out-of-bounds write and escalate into the kernel. The root cause is an incorrect bounds check (CWE-787) in the Wi-Fi access-point driver code path shipped through the MediaTek Software Development Kit and integrated into OpenWrt 19.07.0 and 21.02.0 builds; no user interaction is required and the vector is strictly local. Our independent assessment places the prerequisite at PR:H (the attacker must already possess System privilege), which is stricter than the published vector's PR:L, and no public exploit code was identified at time of analysis, with EPSS at just 0.14% (3rd percentile) - so the practical exposure is post-compromise privilege chaining on devices running the vulnerable driver rather than opportunistic exploitation. MediaTek has published a fix under patch ID WCNCR00421149 in its October 2025 product security bulletin.
An out-of-bounds write in MediaTek's wlan AP driver (CVE-2025-20715, CWE-787) lets a local attacker who already holds System privilege escalate to kernel-level code execution, because the driver performs an incorrect bounds check when handling data. The affected surface spans MediaTek's software development kit and OpenWrt 19.07.0 and 21.02.0 platforms that embed the driver, and exploitation requires local access plus pre-existing high privileges per our assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with no user interaction. EPSS is only 0.14% (3rd percentile) and no public exploit code has been identified, so this is a conditional local privilege-boundary escape rather than an internet-facing emergency; a vendor patch (Patch ID WCNCR00421152, Issue MSV-3731) is referenced in MediaTek's October 2025 security bulletin.
Local privilege escalation in MediaTek's WLAN AP driver allows an attacker who already holds System privilege to trigger an out-of-bounds stack write, potentially gaining higher-level code execution on affected devices. The flaw affects the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 builds that incorporate the vulnerable driver. No user interaction is required, but the attacker must first obtain System privileges, which limits the practical risk; no public exploit identified at time of analysis, and EPSS is low at 0.14% (3rd percentile).
Local privilege escalation in the MediaTek wlan AP driver lets an attacker who already holds System privilege trigger an out-of-bounds stack write through an incorrect bounds check, escalating to full confidentiality, integrity, and availability impact (CVSS 3.1 7.8, assessed vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) without any user interaction. Affected deployments include the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 builds that embed the vulnerable MediaTek wireless driver. No public exploit code or confirmed active exploitation has been identified (EPSS 0.14%, 3rd percentile), which is consistent with a second-stage escalation that requires a prior System-level compromise rather than an initial-access vector.
An out-of-bounds heap write in the MediaTek WLAN access-point driver lets an unauthenticated attacker inside wireless radio range execute code with the driver's privileges on affected devices. The flaw is reachable through malformed 802.11 frame handling in AP mode and requires no credentials and no user interaction, giving it a high 8.8 CVSS score; the practical barrier is physical proximity, since it is not exploitable over the general internet. Badly impacted builds include the MediaTek Software Development Kit and OpenWrt 21.02.0 and 23.05, and MediaTek has issued patch ID WCNCR00422323 via its October 2025 security bulletin; EPSS is low at 0.30% (20th percentile) and no public exploit has been identified at time of analysis.
An out-of-bounds write in the MediaTek WLAN access-point (AP) driver lets an unauthenticated attacker within wireless radio range corrupt memory and escalate privileges on affected access points. Exploitation requires the device to be running the vulnerable driver in AP mode - typically MediaTek SDK-based firmware or OpenWrt 19.07.0/21.02.0 images built for MediaTek Wi-Fi chipsets - and no user interaction or credentials are needed (PR:N/UI:N), though the attacker must be physically proximate (AV:A). The flaw has a public vendor fix (Patch ID WCNCR00422399, issue MSV-3748) and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, with EPSS sitting at a low 0.31% (22nd percentile), so risk is best characterized as technically serious but not yet broadly targeted.
Out-of-bounds write in MediaTek's WLAN access-point driver lets an attacker within wireless range corrupt memory and escalate privileges on the affected device, with no authentication or user interaction required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N, score 8.8). An integer overflow in the AP driver code path results in an out-of-bounds write that can yield high confidentiality, integrity, and availability impact on the open-source MediaTek software development kit and on OpenWrt releases 19.07.0 and 21.02.0, which ship the affected driver. Exploitability is bounded by radio proximity - the flaw is not internet-reachable - and there is no public exploit identified at time of analysis, with EPSS at 0.30% (20th percentile), indicating low near-term exploitation likelihood despite the high severity score. MediaTek has issued a fix (Patch ID WCNCR00418785) referenced in its October 2025 product security bulletin.
An out-of-bounds write in the MediaTek WLAN AP driver allows an attacker within wireless radio range of an affected access point to corrupt memory and escalate privileges without authentication or user interaction (CVSS 8.8, AV:A/AC:L/PR:N/UI:N, scope unchanged, high confidentiality, integrity, and availability impact). The root cause is an incorrect bounds check (CWE-120) applied to WLAN frames handled by the driver, affecting MediaTek SDK-based firmware as well as OpenWrt 19.07.0 and 21.02.0 builds that ship this driver. EPSS is low (0.31%, 22nd percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis, but because the flaw is reachable over the air with no credentials and no user action, exposed APs should be prioritized for patched firmware.
In monitor_hang, there is a possible memory corruption due to use after free. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09741871; Issue ID: MSV-3317.
In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09752821; Issue ID: MSV-3342.
In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09812521; Issue ID: MSV-3421.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418040; Issue ID: MSV-3476.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418039; Issue ID: MSV-3477.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418038; Issue ID: MSV-3478.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418048; Issue ID: MSV-3479.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418047; Issue ID: MSV-3480.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00415570; Issue ID: MSV-3404.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416226; Issue ID: MSV-3409.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416938; Issue ID: MSV-3444.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416937; Issue ID: MSV-3445.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416936; Issue ID: MSV-3446.
Remote privilege escalation in Android WLAN AP driver via packet injection.
In DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In da, there is a possible out of bounds read due to a missing bounds check. Rated medium severity (CVSS 4.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In da, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible reachable assertion due to improper exception handling. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible out of bounds write due to improper input validation. Rated high severity (CVSS 8.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Bluetooth firmware, there is a possible firmware asssert due to improper handling of exceptional conditions. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In da, there is a possible out of bounds read due to a missing bounds check. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In da, there is a possible out of bounds read due to a missing bounds check. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In da, there is a possible out of bounds write due to a missing bounds check. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authenticated delegated LuCI sessions that hold the luci-app-advanced-reboot read ACL can execute arbitrary commands as root on affected OpenWrt routers, because that read ACL grants rpcd file.exec permission for the general shell interpreter /bin/sh and passes caller-controlled parameters to it. Only builds that actually ship this /bin/sh exec grant prior to version 1.1.2-6 are vulnerable; the vendor explicitly states the checked openwrt-24.10 and openwrt-23.05 branches do not carry the grant and are not affected by this chain. Exploitation requires a valid low-privilege delegated rpcd/LuCI session (CVSS vector PR:L, no unauthenticated path), and no public exploit code was identified at time of analysis; the issue is fixed in 1.1.2-6.
Persistent root command execution in luci-app-adblock-fast prior to 1.2.4-2 on OpenWrt: an authenticated LuCI user who has been granted the component's write ACL can abuse the luci.adblock-fast.setCronEntry RPC by embedding carriage-return or line-feed characters in the entry argument. Because the value is serialized into /etc/crontabs/root as if it were a single line, the delegated user can create an additional physical cron entry that runs as UID 0 when cron executes. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) is directionally sound but materially gated by the mandatory pre-existing luci-app-adblock-fast write ACL and by cron actually running; exploitation is not demonstrated for unauthenticated users or users lacking that ACL. No public exploit identified at time of analysis, and the vendor fix is 1.2.4-2.
OS command injection in OpenWrt's luci-app-dockerman grants any authenticated user holding only the read ACL full root-level code execution on the affected router. The vulnerable run_ttyd handler in the ucode docker_rpc.uc backend constructs a shell command from attacker-controlled request fields (id, cmd, uid) and passes them unsanitized to system() within the rpcd root context, reachable via a simple HTTP POST to /ubus. Only LuCI master and openwrt-25.12 snapshots after the JS-to-ucode backend conversion are affected; upstream patch commits exist but no released patched snapshot version was confirmed as of the advisory, and no public exploit is identified at time of analysis.
Unauthenticated path traversal in OpenWrt's luci-app-bmx7 package exposes arbitrary files on affected routers via the bmx7-info CGI endpoint. Attackers can supply directory traversal sequences in the CGI query string to escape the configured runtimeDir and read any file readable by the CGI process, including credentials, network configuration, or cryptographic keys stored on the device. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated network attack vector (CVSS 4.0: 8.7) presents a low barrier to opportunistic exploitation against exposed management interfaces.
Stored cross-site scripting in OpenWrt's default odhcpd server (all releases prior to 25.12.5) lets a network-adjacent DHCP client inject forged lease records that execute as HTML/JavaScript in a router administrator's browser. The client-supplied DHCPv6 FQDN option 39 (and DHCPv4 option 12) hostname is written unescaped into /tmp/odhcpd.leases, enabling newline injection of attacker-controlled fields that LuCI's Active DHCPv6 Leases page renders via unsafe dom.append. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; it is fixed in 25.12.5.
Ban-list poisoning in OpenWrt's luci-app-banip (banIP) before 1.8.10 lets an unauthenticated remote attacker steer the automated IP-blocking engine at an arbitrary victim. Because the awk-based log monitor grabs the first IPv4 address it finds on a log line regardless of field position, an attacker can embed a spoofed IP inside an attacker-controlled field such as a login username; banIP then bans that injected address while the real attacker's source IP is never blocked. Reported by VulnCheck with a vendor patch available; no public exploit code or active exploitation is identified at time of analysis.
Stored cross-site scripting in OpenWrt's LuCI web interface lets an adjacent-network attacker inject executable HTML/JavaScript by supplying a malicious DHCPv6 Client FQDN hostname, which the DHCP lease status tables render without proper output encoding. When an administrator views the DHCP lease page, the payload executes in their authenticated browser session, enabling router admin-panel compromise. Rated CVSS 4.0 9.4 (Critical) by the vendor; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in OpenWrt's luci-app-upnp lets an unauthenticated LAN client persist a JavaScript payload that executes in the router administrator's browser. By supplying malicious HTML in the NewPortMappingDescription field of a UPnP IGD AddPortMapping SOAP request, an attacker gets miniupnpd to store the value and luci-app-upnp to render it unencoded on the UPnP and Status pages. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High).
Privilege escalation to root in OpenWrt's luci-app-samba4 (LuCI web interface) lets authenticated delegated users invoke the root-owned Samba daemon with attacker-controlled arguments. The package's 'read' ACL improperly grants file.exec permission on /usr/sbin/smbd, so a low-privileged operator can launch smbd with global options like 'message command' and achieve arbitrary command execution as root when SMB messages are processed. Reported by VulnCheck with a GHSA advisory published; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Root-level command injection in OpenWrt's luci-app-travelmate/travelmate (confirmed in 2.4.5-r3, sink still present in 2.4.6-1) lets an rpcd/LuCI session holding only the luci-app-travelmate write ACL escalate to arbitrary command execution as root. The LuCI UI limits the auto-login script picker to /etc/travelmate/*.login, but that is a frontend-only check: the root-run backend reads the raw UCI 'script' and 'script_args' values, so an attacker sets script to /bin/sh with controlled arguments to run commands as root when the captive-portal auto-login branch fires. Reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Root command injection in OpenWrt's LuCI web interface (luci-proto-openvpn through 0.11.1) lets an authenticated user with OpenVPN protocol configuration access run arbitrary commands as root. The flaw lives in the generateKey ubus method, where the cl_meta parameter is passed unescaped into a popen() shell call. No public exploit has been identified at time of analysis, but a vendor advisory (GHSA-pm9w-522m-8rrh) and fix commit exist, and the CVSS 4.0 score of 8.7 reflects full confidentiality, integrity, and availability impact on the affected device.
Authenticated root command injection in the OpenWrt LuCI community Tailscale app (luci-app-tailscale-community) lets a logged-in web UI user run arbitrary OS commands as root through the tailscale.do_login RPC method. Because the user-supplied loginserver and loginserver_authkey values are placed inside a double-quoted shell string, $() and backtick substitutions are evaluated by the outer shell, turning configuration input into command execution. Reported by VulnCheck with a published GHSA advisory; no public exploit identified at time of analysis and the issue is not in CISA KEV.
A stored cross-site scripting (XSS) vulnerability exists in the OpenWrt LuCI web interface where malicious JavaScript code embedded in Wi-Fi network names (SSIDs) can execute when users open the wireless scan modal. The vulnerability affects OpenWrt versions newer than 23.05/22.03 up to 24.10.5 and 25.12.0, allowing attackers within wireless range to compromise users who scan for available networks. No active exploitation has been reported (not in KEV), and with an EPSS score not provided, the real-world exploitation risk appears limited despite the high CVSS score of 8.6.
OpenWrt versions prior to 24.10.6 allow local attackers with limited privileges to inject a malicious PATH environment variable into hotplug scripts due to improper filtering in the hotplug_call function, enabling execution of arbitrary binaries with elevated privileges. The vulnerability stems from a strcmp/strncmp logic error that fails to properly exclude the PATH variable when executing scripts in /etc/hotplug.d, resulting in local privilege escalation. No patch is currently available.
Remote code execution in OpenWrt's mDNS daemon (versions before 24.10.6 and 25.12.1) allows unauthenticated attackers to overflow a 46-byte stack buffer by sending malformed IPv6 PTR queries over multicast DNS on UDP port 5353. The vulnerability stems from insufficient validation of domain name length before copying to a fixed-size buffer, enabling arbitrary code execution on affected embedded devices. No patch is currently available.
Remote code execution in OpenWrt mdns daemon (versions before 24.10.6 and 25.12.1) allows unauthenticated attackers to crash the service or execute arbitrary code by sending specially crafted DNS PTR queries to UDP port 5353, exploiting a stack buffer overflow in the parse_question function. The vulnerability occurs when domain names are expanded and copied without bounds checking, with non-printable characters inflating the payload beyond the fixed 256-byte buffer. No patch is currently available for affected embedded device deployments.
OpenWrt and its Software Development Kit contain an out-of-bounds write vulnerability in the WLAN access point firmware caused by improper bounds checking, enabling adjacent network attackers to achieve privilege escalation without user interaction or special privileges. The vulnerability carries high severity with complete impact across confidentiality, integrity, and availability, though no patch is currently available.
OpenWRT and related SDKs are vulnerable to a heap buffer overflow in the WLAN component that allows adjacent network attackers to execute privilege escalation without user interaction or special permissions. The out-of-bounds write condition enables attackers on the same network segment to gain elevated system privileges. No patch is currently available for this vulnerability.
Unauthenticated flooding of crafted DHCPv6 RENEW messages can repeatedly crash odhcpd, the DHCPv6/DHCPv4/router-advertisement server shipped and enabled by default on OpenWrt, denying IPv6 address configuration to clients on the local link. An attacker who is network-adjacent (AV:A, PR:N, UI:N) must first complete two legitimate SOLICIT/REQUEST exchanges to obtain bindings, then send a single RENEW containing multiple IA_NA options that triggers an unsigned size_t underflow and lets attacker-controlled data be serialized past the 512-byte stack buffer pdbuf; the stack canary terminates the daemon and procd respawns it, so sustained packets cause recurring DHCPv6 outages. Impact is availability-only (C:N/I:N/A:H) and the observed configuration does not establish code execution; no public exploit identified at time of analysis, and the issue is fixed in OpenWrt 25.12.5.
Heap-based buffer overflow in luci-lib-px5g's native ASN.1 encoding routine allows a locally authenticated attacker to write one byte beyond a heap-allocated buffer during certificate signing, with a high availability impact and limited confidentiality and integrity exposure. The flaw is triggered specifically when signing with a 2040-bit RSA key via the exported Lua interface create_selfsigned(), where a DER length encoding miscalculation causes an allocation of 259 bytes for a payload requiring 260. Remote exploitability is not confirmed - it depends entirely on whether the embedding application exposes this interface externally. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stored cross-site scripting in luci-app-adblock-fast before 1.2.4-4 allows a lower-privileged LuCI user to inject malicious JavaScript into the blocklist name field, which executes in an administrator's browser under the LuCI origin when the AdBlock Fast status page is viewed. Because the payload runs within the LuCI same-origin context, a successful attack could enable session hijacking, unauthorized router reconfiguration, or privilege escalation from low-privileged user to effective admin control. No public exploit is identified at time of analysis; a vendor patch is available via the GitHub Security Advisory GHSA-q335-4c83-c88h.
Stored cross-site scripting in luci-app-https-dns-proxy allows a highly privileged but potentially lower-trust authenticated LuCI user to persist a malicious JavaScript payload via the resolver_url parameter, which then silently executes in any administrator's browser when the HTTPS DNS Proxy status page is loaded. All currently tracked LuCI versions appear affected per EUVD listing (luci 0 <*). No public exploit code or CISA KEV listing is confirmed at time of analysis, though the stored nature of this XSS makes it more dangerous than a reflected variant because no additional attacker interaction is needed after initial injection.
Path traversal in OpenWrt's cgi-io cgi-download handler (prior to 25.12.5) allows an authenticated administrator to read arbitrary root-readable files - including /etc/shadow - by exploiting a TOCTOU-style authorization flaw where ACL checks occur before path canonicalization. The rpcd session.c ACL matcher uses fnmatch() without FNM_PATHNAME, meaning a wildcard-prefixed ACL entry (e.g., /etc/config/*) can be defeated by appending ../ sequences that pass the ACL check but resolve to an out-of-scope file when open() is called. No public exploit identified at time of analysis; vendor-released patch is available in v25.12.5.
Integer underflow in the OpenWrt Emergency Access Daemon crashes the daemon when any unauthenticated attacker on the local network sends a single crafted UDP packet to it. Affected are all OpenWrt versions prior to v25.12.5. The CVSS adjacent-network vector (AV:A) constrains the attack surface to local or adjacent network segments, but within that context exploitation requires no credentials and no user interaction - a single malformed packet suffices. No public exploit code or CISA KEV listing has been identified at time of analysis; the patch is confirmed available in v25.12.5.
A security vulnerability in versions (CVSS 4.9). Remediation should follow standard vulnerability management procedures.
Device unique identifiers in the preloader of Openwrt, Android, Yocto, RDK-B, and Zephyr can be read by attackers with physical access due to a logic error, leading to local information disclosure without requiring additional privileges or user interaction. This vulnerability affects multiple embedded and IoT platforms where the preloader executes before operating system initialization. No patch is currently available for this issue.
An uncaught exception in WLAN AP/STA firmware for NBIoT SDK, OpenWrt, and related development kits enables adjacent network attackers to trigger a denial of service condition that renders the system unresponsive without requiring authentication or user interaction. The vulnerability affects multiple wireless products and has no available patch at this time, presenting a medium-severity risk in networked environments.
In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In preloader, there is a possible escalation of privilege due to an insecure default value. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds read in the MediaTek wlan AP driver allows a locally authenticated low-privileged user to read memory beyond an intended buffer boundary and disclose potentially sensitive information from devices running the vulnerable driver, including MediaTek Software Development Kit builds and OpenWrt 19.07.0 and 21.02.0 systems. Exploitation requires existing local access to the device (CVSS 3.1 AV:L/PR:L/UI:N, base score 5.5) and no user interaction, and the impact is confined to confidentiality only, with no integrity or availability effect and no code execution. There is no public exploit code identified and no confirmed active exploitation at time of analysis, and the EPSS score is low (0.14%, 3rd percentile); MediaTek has published a fix (patch ID WCNCR00418894, issue MSV-3475) in its October 2025 product security bulletin.
An out-of-bounds read caused by an integer overflow (CWE-190) in the MediaTek GNSS driver can disclose memory contents on affected devices, but only to an attacker who has already obtained the Android System privilege. The flaw is local-only (AV:L), requires no user interaction, and yields confidentiality impact only, with no integrity or availability effect. No public exploit code has been identified at time of analysis, EPSS is negligible (0.09%), and the vendor has released a fix (Patch ID ALPS09920036) in the October 2025 MediaTek product security bulletin, so the practical risk is low despite the MEDIUM 5.5 base score.
A heap-based out-of-bounds write in the MediaTek WLAN AP driver lets an attacker within wireless/radio range corrupt kernel memory by sending crafted 802.11 frames that defeat an incorrect bounds check, yielding full confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N) with no authentication, no user interaction and no prior privileges required. Exposure is limited to devices whose access-point/SoftAP code path runs the vulnerable MediaTek SDK driver, including OpenWrt 19.07.0 and 21.02.0 builds that bundle it, and the flaw is not routable over the internet. Per the provided data there is no public exploit identified at time of analysis and no CISA KEV listing, and the low EPSS score (0.26%, 16th percentile) reflects the RF-proximity precondition rather than a lack of severity.
A stack-based out-of-bounds write (CWE-121) in the MediaTek WLAN AP driver lets an attacker who is within wireless radio range of a vulnerable access point corrupt memory without authenticating and without any user interaction, yielding a full compromise of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected builds include the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 images that ship the vulnerable driver, and exploitation requires the device to be operating in access-point mode so it parses the malicious wireless frames. At time of analysis EPSS is only 0.26% (16th percentile) and no public exploit code has been identified, so the practical risk is dominated by the adjacency requirement - an attacker must be physically close enough to the AP to transmit crafted frames.
An out-of-bounds write (stack-based buffer overflow, CWE-121) in the MediaTek WLAN AP driver lets a local attacker with ordinary 'User' execution privileges corrupt adjacent stack memory and escalate to higher privileges in the driver's context. Exploitation requires pre-existing local code execution on a device running an affected MediaTek SDK WLAN AP driver build - confirmed in CPE data for the MediaTek software development kit and OpenWrt 19.07.0 and 21.02.0 - with no user interaction and no network reachability involved (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). Exploit maturity is low: no public exploit code was identified at time of analysis and EPSS is only 0.17% (5th percentile), so this is a post-compromise privilege-escalation primitive rather than an urgent remotely exploitable flaw.
Local privilege escalation in the MediaTek WLAN AP driver (shipped via the MediaTek Software Development Kit and integrated into OpenWrt 19.07.0 and 21.02.0 builds on MediaTek-based hardware) allows an attacker who already holds System privilege on the device to trigger a stack-based out-of-bounds write and gain elevated code execution. Exploitation requires local access to the affected driver interface and a pre-existing System-privilege foothold, so this is a second-stage escalation primitive rather than an initial-access or remote vulnerability; user interaction is not required. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published a fix (Patch ID WCNCR00419946) in its October 2025 product security bulletin.
Local privilege escalation in the MediaTek wlan AP driver lets an attacker who already holds System privilege on an affected MediaTek-based device trigger an out-of-bounds write and escalate into the kernel. The root cause is an incorrect bounds check (CWE-787) in the Wi-Fi access-point driver code path shipped through the MediaTek Software Development Kit and integrated into OpenWrt 19.07.0 and 21.02.0 builds; no user interaction is required and the vector is strictly local. Our independent assessment places the prerequisite at PR:H (the attacker must already possess System privilege), which is stricter than the published vector's PR:L, and no public exploit code was identified at time of analysis, with EPSS at just 0.14% (3rd percentile) - so the practical exposure is post-compromise privilege chaining on devices running the vulnerable driver rather than opportunistic exploitation. MediaTek has published a fix under patch ID WCNCR00421149 in its October 2025 product security bulletin.
An out-of-bounds write in MediaTek's wlan AP driver (CVE-2025-20715, CWE-787) lets a local attacker who already holds System privilege escalate to kernel-level code execution, because the driver performs an incorrect bounds check when handling data. The affected surface spans MediaTek's software development kit and OpenWrt 19.07.0 and 21.02.0 platforms that embed the driver, and exploitation requires local access plus pre-existing high privileges per our assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with no user interaction. EPSS is only 0.14% (3rd percentile) and no public exploit code has been identified, so this is a conditional local privilege-boundary escape rather than an internet-facing emergency; a vendor patch (Patch ID WCNCR00421152, Issue MSV-3731) is referenced in MediaTek's October 2025 security bulletin.
Local privilege escalation in MediaTek's WLAN AP driver allows an attacker who already holds System privilege to trigger an out-of-bounds stack write, potentially gaining higher-level code execution on affected devices. The flaw affects the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 builds that incorporate the vulnerable driver. No user interaction is required, but the attacker must first obtain System privileges, which limits the practical risk; no public exploit identified at time of analysis, and EPSS is low at 0.14% (3rd percentile).
Local privilege escalation in the MediaTek wlan AP driver lets an attacker who already holds System privilege trigger an out-of-bounds stack write through an incorrect bounds check, escalating to full confidentiality, integrity, and availability impact (CVSS 3.1 7.8, assessed vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) without any user interaction. Affected deployments include the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 builds that embed the vulnerable MediaTek wireless driver. No public exploit code or confirmed active exploitation has been identified (EPSS 0.14%, 3rd percentile), which is consistent with a second-stage escalation that requires a prior System-level compromise rather than an initial-access vector.
An out-of-bounds heap write in the MediaTek WLAN access-point driver lets an unauthenticated attacker inside wireless radio range execute code with the driver's privileges on affected devices. The flaw is reachable through malformed 802.11 frame handling in AP mode and requires no credentials and no user interaction, giving it a high 8.8 CVSS score; the practical barrier is physical proximity, since it is not exploitable over the general internet. Badly impacted builds include the MediaTek Software Development Kit and OpenWrt 21.02.0 and 23.05, and MediaTek has issued patch ID WCNCR00422323 via its October 2025 security bulletin; EPSS is low at 0.30% (20th percentile) and no public exploit has been identified at time of analysis.
An out-of-bounds write in the MediaTek WLAN access-point (AP) driver lets an unauthenticated attacker within wireless radio range corrupt memory and escalate privileges on affected access points. Exploitation requires the device to be running the vulnerable driver in AP mode - typically MediaTek SDK-based firmware or OpenWrt 19.07.0/21.02.0 images built for MediaTek Wi-Fi chipsets - and no user interaction or credentials are needed (PR:N/UI:N), though the attacker must be physically proximate (AV:A). The flaw has a public vendor fix (Patch ID WCNCR00422399, issue MSV-3748) and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, with EPSS sitting at a low 0.31% (22nd percentile), so risk is best characterized as technically serious but not yet broadly targeted.
Out-of-bounds write in MediaTek's WLAN access-point driver lets an attacker within wireless range corrupt memory and escalate privileges on the affected device, with no authentication or user interaction required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N, score 8.8). An integer overflow in the AP driver code path results in an out-of-bounds write that can yield high confidentiality, integrity, and availability impact on the open-source MediaTek software development kit and on OpenWrt releases 19.07.0 and 21.02.0, which ship the affected driver. Exploitability is bounded by radio proximity - the flaw is not internet-reachable - and there is no public exploit identified at time of analysis, with EPSS at 0.30% (20th percentile), indicating low near-term exploitation likelihood despite the high severity score. MediaTek has issued a fix (Patch ID WCNCR00418785) referenced in its October 2025 product security bulletin.
An out-of-bounds write in the MediaTek WLAN AP driver allows an attacker within wireless radio range of an affected access point to corrupt memory and escalate privileges without authentication or user interaction (CVSS 8.8, AV:A/AC:L/PR:N/UI:N, scope unchanged, high confidentiality, integrity, and availability impact). The root cause is an incorrect bounds check (CWE-120) applied to WLAN frames handled by the driver, affecting MediaTek SDK-based firmware as well as OpenWrt 19.07.0 and 21.02.0 builds that ship this driver. EPSS is low (0.31%, 22nd percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis, but because the flaw is reachable over the air with no credentials and no user action, exposed APs should be prioritized for patched firmware.
In monitor_hang, there is a possible memory corruption due to use after free. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09741871; Issue ID: MSV-3317.
In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09752821; Issue ID: MSV-3342.
In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09812521; Issue ID: MSV-3421.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418040; Issue ID: MSV-3476.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418039; Issue ID: MSV-3477.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418038; Issue ID: MSV-3478.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418048; Issue ID: MSV-3479.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418047; Issue ID: MSV-3480.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00415570; Issue ID: MSV-3404.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416226; Issue ID: MSV-3409.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416938; Issue ID: MSV-3444.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416937; Issue ID: MSV-3445.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416936; Issue ID: MSV-3446.
Remote privilege escalation in Android WLAN AP driver via packet injection.
In DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In da, there is a possible out of bounds read due to a missing bounds check. Rated medium severity (CVSS 4.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In da, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible reachable assertion due to improper exception handling. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible out of bounds write due to improper input validation. Rated high severity (CVSS 8.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In V6 DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Bluetooth firmware, there is a possible firmware asssert due to improper handling of exceptional conditions. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In da, there is a possible out of bounds read due to a missing bounds check. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In da, there is a possible out of bounds read due to a missing bounds check. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In da, there is a possible out of bounds write due to a missing bounds check. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.