Software Development Kit
Monthly
OpenWrt and its Software Development Kit contain an out-of-bounds write vulnerability in the WLAN access point firmware caused by improper bounds checking, enabling adjacent network attackers to achieve privilege escalation without user interaction or special privileges. The vulnerability carries high severity with complete impact across confidentiality, integrity, and availability, though no patch is currently available.
OpenWRT and related SDKs are vulnerable to a heap buffer overflow in the WLAN component that allows adjacent network attackers to execute privilege escalation without user interaction or special permissions. The out-of-bounds write condition enables attackers on the same network segment to gain elevated system privileges. No patch is currently available for this vulnerability.
An uncaught exception in WLAN AP/STA firmware for NBIoT SDK, OpenWrt, and related development kits enables adjacent network attackers to trigger a denial of service condition that renders the system unresponsive without requiring authentication or user interaction. The vulnerability affects multiple wireless products and has no available patch at this time, presenting a medium-severity risk in networked environments.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible out of bounds read due to a race condition. Rated medium severity (CVSS 4.7). No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds read in the MediaTek wlan AP driver allows a locally authenticated low-privileged user to read memory beyond an intended buffer boundary and disclose potentially sensitive information from devices running the vulnerable driver, including MediaTek Software Development Kit builds and OpenWrt 19.07.0 and 21.02.0 systems. Exploitation requires existing local access to the device (CVSS 3.1 AV:L/PR:L/UI:N, base score 5.5) and no user interaction, and the impact is confined to confidentiality only, with no integrity or availability effect and no code execution. There is no public exploit code identified and no confirmed active exploitation at time of analysis, and the EPSS score is low (0.14%, 3rd percentile); MediaTek has published a fix (patch ID WCNCR00418894, issue MSV-3475) in its October 2025 product security bulletin.
A heap-based out-of-bounds write in the MediaTek WLAN AP driver lets an attacker within wireless/radio range corrupt kernel memory by sending crafted 802.11 frames that defeat an incorrect bounds check, yielding full confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N) with no authentication, no user interaction and no prior privileges required. Exposure is limited to devices whose access-point/SoftAP code path runs the vulnerable MediaTek SDK driver, including OpenWrt 19.07.0 and 21.02.0 builds that bundle it, and the flaw is not routable over the internet. Per the provided data there is no public exploit identified at time of analysis and no CISA KEV listing, and the low EPSS score (0.26%, 16th percentile) reflects the RF-proximity precondition rather than a lack of severity.
A stack-based out-of-bounds write (CWE-121) in the MediaTek WLAN AP driver lets an attacker who is within wireless radio range of a vulnerable access point corrupt memory without authenticating and without any user interaction, yielding a full compromise of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected builds include the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 images that ship the vulnerable driver, and exploitation requires the device to be operating in access-point mode so it parses the malicious wireless frames. At time of analysis EPSS is only 0.26% (16th percentile) and no public exploit code has been identified, so the practical risk is dominated by the adjacency requirement - an attacker must be physically close enough to the AP to transmit crafted frames.
An out-of-bounds write (stack-based buffer overflow, CWE-121) in the MediaTek WLAN AP driver lets a local attacker with ordinary 'User' execution privileges corrupt adjacent stack memory and escalate to higher privileges in the driver's context. Exploitation requires pre-existing local code execution on a device running an affected MediaTek SDK WLAN AP driver build - confirmed in CPE data for the MediaTek software development kit and OpenWrt 19.07.0 and 21.02.0 - with no user interaction and no network reachability involved (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). Exploit maturity is low: no public exploit code was identified at time of analysis and EPSS is only 0.17% (5th percentile), so this is a post-compromise privilege-escalation primitive rather than an urgent remotely exploitable flaw.
Local privilege escalation in the MediaTek WLAN AP driver (shipped via the MediaTek Software Development Kit and integrated into OpenWrt 19.07.0 and 21.02.0 builds on MediaTek-based hardware) allows an attacker who already holds System privilege on the device to trigger a stack-based out-of-bounds write and gain elevated code execution. Exploitation requires local access to the affected driver interface and a pre-existing System-privilege foothold, so this is a second-stage escalation primitive rather than an initial-access or remote vulnerability; user interaction is not required. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published a fix (Patch ID WCNCR00419946) in its October 2025 product security bulletin.
Local privilege escalation in the MediaTek wlan AP driver lets an attacker who already holds System privilege on an affected MediaTek-based device trigger an out-of-bounds write and escalate into the kernel. The root cause is an incorrect bounds check (CWE-787) in the Wi-Fi access-point driver code path shipped through the MediaTek Software Development Kit and integrated into OpenWrt 19.07.0 and 21.02.0 builds; no user interaction is required and the vector is strictly local. Our independent assessment places the prerequisite at PR:H (the attacker must already possess System privilege), which is stricter than the published vector's PR:L, and no public exploit code was identified at time of analysis, with EPSS at just 0.14% (3rd percentile) - so the practical exposure is post-compromise privilege chaining on devices running the vulnerable driver rather than opportunistic exploitation. MediaTek has published a fix under patch ID WCNCR00421149 in its October 2025 product security bulletin.
An out-of-bounds write in MediaTek's wlan AP driver (CVE-2025-20715, CWE-787) lets a local attacker who already holds System privilege escalate to kernel-level code execution, because the driver performs an incorrect bounds check when handling data. The affected surface spans MediaTek's software development kit and OpenWrt 19.07.0 and 21.02.0 platforms that embed the driver, and exploitation requires local access plus pre-existing high privileges per our assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with no user interaction. EPSS is only 0.14% (3rd percentile) and no public exploit code has been identified, so this is a conditional local privilege-boundary escape rather than an internet-facing emergency; a vendor patch (Patch ID WCNCR00421152, Issue MSV-3731) is referenced in MediaTek's October 2025 security bulletin.
Local privilege escalation in MediaTek's WLAN AP driver allows an attacker who already holds System privilege to trigger an out-of-bounds stack write, potentially gaining higher-level code execution on affected devices. The flaw affects the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 builds that incorporate the vulnerable driver. No user interaction is required, but the attacker must first obtain System privileges, which limits the practical risk; no public exploit identified at time of analysis, and EPSS is low at 0.14% (3rd percentile).
Local privilege escalation in the MediaTek wlan AP driver lets an attacker who already holds System privilege trigger an out-of-bounds stack write through an incorrect bounds check, escalating to full confidentiality, integrity, and availability impact (CVSS 3.1 7.8, assessed vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) without any user interaction. Affected deployments include the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 builds that embed the vulnerable MediaTek wireless driver. No public exploit code or confirmed active exploitation has been identified (EPSS 0.14%, 3rd percentile), which is consistent with a second-stage escalation that requires a prior System-level compromise rather than an initial-access vector.
An out-of-bounds heap write in the MediaTek WLAN access-point driver lets an unauthenticated attacker inside wireless radio range execute code with the driver's privileges on affected devices. The flaw is reachable through malformed 802.11 frame handling in AP mode and requires no credentials and no user interaction, giving it a high 8.8 CVSS score; the practical barrier is physical proximity, since it is not exploitable over the general internet. Badly impacted builds include the MediaTek Software Development Kit and OpenWrt 21.02.0 and 23.05, and MediaTek has issued patch ID WCNCR00422323 via its October 2025 security bulletin; EPSS is low at 0.30% (20th percentile) and no public exploit has been identified at time of analysis.
An out-of-bounds write in the MediaTek WLAN access-point (AP) driver lets an unauthenticated attacker within wireless radio range corrupt memory and escalate privileges on affected access points. Exploitation requires the device to be running the vulnerable driver in AP mode - typically MediaTek SDK-based firmware or OpenWrt 19.07.0/21.02.0 images built for MediaTek Wi-Fi chipsets - and no user interaction or credentials are needed (PR:N/UI:N), though the attacker must be physically proximate (AV:A). The flaw has a public vendor fix (Patch ID WCNCR00422399, issue MSV-3748) and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, with EPSS sitting at a low 0.31% (22nd percentile), so risk is best characterized as technically serious but not yet broadly targeted.
Out-of-bounds write in MediaTek's WLAN access-point driver lets an attacker within wireless range corrupt memory and escalate privileges on the affected device, with no authentication or user interaction required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N, score 8.8). An integer overflow in the AP driver code path results in an out-of-bounds write that can yield high confidentiality, integrity, and availability impact on the open-source MediaTek software development kit and on OpenWrt releases 19.07.0 and 21.02.0, which ship the affected driver. Exploitability is bounded by radio proximity - the flaw is not internet-reachable - and there is no public exploit identified at time of analysis, with EPSS at 0.30% (20th percentile), indicating low near-term exploitation likelihood despite the high severity score. MediaTek has issued a fix (Patch ID WCNCR00418785) referenced in its October 2025 product security bulletin.
An out-of-bounds write in the MediaTek WLAN AP driver allows an attacker within wireless radio range of an affected access point to corrupt memory and escalate privileges without authentication or user interaction (CVSS 8.8, AV:A/AC:L/PR:N/UI:N, scope unchanged, high confidentiality, integrity, and availability impact). The root cause is an incorrect bounds check (CWE-120) applied to WLAN frames handled by the driver, affecting MediaTek SDK-based firmware as well as OpenWrt 19.07.0 and 21.02.0 builds that ship this driver. EPSS is low (0.31%, 22nd percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis, but because the flaw is reachable over the air with no credentials and no user action, exposed APs should be prioritized for patched firmware.
In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09741871; Issue ID: MSV-3317.
In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09752821; Issue ID: MSV-3342.
In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09812521; Issue ID: MSV-3421.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418040; Issue ID: MSV-3476.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418039; Issue ID: MSV-3477.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418038; Issue ID: MSV-3478.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418048; Issue ID: MSV-3479.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418047; Issue ID: MSV-3480.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00415570; Issue ID: MSV-3404.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416226; Issue ID: MSV-3409.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416939; Issue ID: MSV-3422.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416938; Issue ID: MSV-3444.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416937; Issue ID: MSV-3445.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416936; Issue ID: MSV-3446.
Remote privilege escalation in Android WLAN AP driver via packet injection.
In wlan AP driver, there is a possible information disclosure due to an uncaught exception. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible information disclosure due to an uncaught exception. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In wlan AP FW, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In network HW, there is a possible system hang due to an uncaught exception. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible reachable assertion due to improper exception handling. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
In wlan STA FW, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible out of bounds write due to improper input validation. Rated high severity (CVSS 8.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Bluetooth firmware, there is a possible firmware asssert due to improper handling of exceptional conditions. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In wlan driver, there is a possible out of bound read due to improper input validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan firmware, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan driver, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan driver, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan service, there is a possible out of bounds write due to improper input validation. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
In wlan driver, there is a possible out of bounds write due to improper input validation. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
In wlan driver, there is a possible out of bounds read due to improper input validation. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
In wlan driver, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan service, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In wlan driver, there is a possible PIN crack due to use of insufficiently random values. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
matrix-android-sdk2 is the Matrix SDK for Android. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
matrix-android-sdk2 is the Matrix SDK for Android. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device management tools (Welch Allyn Service Tool:. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
OpenWrt and its Software Development Kit contain an out-of-bounds write vulnerability in the WLAN access point firmware caused by improper bounds checking, enabling adjacent network attackers to achieve privilege escalation without user interaction or special privileges. The vulnerability carries high severity with complete impact across confidentiality, integrity, and availability, though no patch is currently available.
OpenWRT and related SDKs are vulnerable to a heap buffer overflow in the WLAN component that allows adjacent network attackers to execute privilege escalation without user interaction or special permissions. The out-of-bounds write condition enables attackers on the same network segment to gain elevated system privileges. No patch is currently available for this vulnerability.
An uncaught exception in WLAN AP/STA firmware for NBIoT SDK, OpenWrt, and related development kits enables adjacent network attackers to trigger a denial of service condition that renders the system unresponsive without requiring authentication or user interaction. The vulnerability affects multiple wireless products and has no available patch at this time, presenting a medium-severity risk in networked environments.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible out of bounds read due to a race condition. Rated medium severity (CVSS 4.7). No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An out-of-bounds read in the MediaTek wlan AP driver allows a locally authenticated low-privileged user to read memory beyond an intended buffer boundary and disclose potentially sensitive information from devices running the vulnerable driver, including MediaTek Software Development Kit builds and OpenWrt 19.07.0 and 21.02.0 systems. Exploitation requires existing local access to the device (CVSS 3.1 AV:L/PR:L/UI:N, base score 5.5) and no user interaction, and the impact is confined to confidentiality only, with no integrity or availability effect and no code execution. There is no public exploit code identified and no confirmed active exploitation at time of analysis, and the EPSS score is low (0.14%, 3rd percentile); MediaTek has published a fix (patch ID WCNCR00418894, issue MSV-3475) in its October 2025 product security bulletin.
A heap-based out-of-bounds write in the MediaTek WLAN AP driver lets an attacker within wireless/radio range corrupt kernel memory by sending crafted 802.11 frames that defeat an incorrect bounds check, yielding full confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N) with no authentication, no user interaction and no prior privileges required. Exposure is limited to devices whose access-point/SoftAP code path runs the vulnerable MediaTek SDK driver, including OpenWrt 19.07.0 and 21.02.0 builds that bundle it, and the flaw is not routable over the internet. Per the provided data there is no public exploit identified at time of analysis and no CISA KEV listing, and the low EPSS score (0.26%, 16th percentile) reflects the RF-proximity precondition rather than a lack of severity.
A stack-based out-of-bounds write (CWE-121) in the MediaTek WLAN AP driver lets an attacker who is within wireless radio range of a vulnerable access point corrupt memory without authenticating and without any user interaction, yielding a full compromise of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected builds include the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 images that ship the vulnerable driver, and exploitation requires the device to be operating in access-point mode so it parses the malicious wireless frames. At time of analysis EPSS is only 0.26% (16th percentile) and no public exploit code has been identified, so the practical risk is dominated by the adjacency requirement - an attacker must be physically close enough to the AP to transmit crafted frames.
An out-of-bounds write (stack-based buffer overflow, CWE-121) in the MediaTek WLAN AP driver lets a local attacker with ordinary 'User' execution privileges corrupt adjacent stack memory and escalate to higher privileges in the driver's context. Exploitation requires pre-existing local code execution on a device running an affected MediaTek SDK WLAN AP driver build - confirmed in CPE data for the MediaTek software development kit and OpenWrt 19.07.0 and 21.02.0 - with no user interaction and no network reachability involved (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). Exploit maturity is low: no public exploit code was identified at time of analysis and EPSS is only 0.17% (5th percentile), so this is a post-compromise privilege-escalation primitive rather than an urgent remotely exploitable flaw.
Local privilege escalation in the MediaTek WLAN AP driver (shipped via the MediaTek Software Development Kit and integrated into OpenWrt 19.07.0 and 21.02.0 builds on MediaTek-based hardware) allows an attacker who already holds System privilege on the device to trigger a stack-based out-of-bounds write and gain elevated code execution. Exploitation requires local access to the affected driver interface and a pre-existing System-privilege foothold, so this is a second-stage escalation primitive rather than an initial-access or remote vulnerability; user interaction is not required. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published a fix (Patch ID WCNCR00419946) in its October 2025 product security bulletin.
Local privilege escalation in the MediaTek wlan AP driver lets an attacker who already holds System privilege on an affected MediaTek-based device trigger an out-of-bounds write and escalate into the kernel. The root cause is an incorrect bounds check (CWE-787) in the Wi-Fi access-point driver code path shipped through the MediaTek Software Development Kit and integrated into OpenWrt 19.07.0 and 21.02.0 builds; no user interaction is required and the vector is strictly local. Our independent assessment places the prerequisite at PR:H (the attacker must already possess System privilege), which is stricter than the published vector's PR:L, and no public exploit code was identified at time of analysis, with EPSS at just 0.14% (3rd percentile) - so the practical exposure is post-compromise privilege chaining on devices running the vulnerable driver rather than opportunistic exploitation. MediaTek has published a fix under patch ID WCNCR00421149 in its October 2025 product security bulletin.
An out-of-bounds write in MediaTek's wlan AP driver (CVE-2025-20715, CWE-787) lets a local attacker who already holds System privilege escalate to kernel-level code execution, because the driver performs an incorrect bounds check when handling data. The affected surface spans MediaTek's software development kit and OpenWrt 19.07.0 and 21.02.0 platforms that embed the driver, and exploitation requires local access plus pre-existing high privileges per our assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with no user interaction. EPSS is only 0.14% (3rd percentile) and no public exploit code has been identified, so this is a conditional local privilege-boundary escape rather than an internet-facing emergency; a vendor patch (Patch ID WCNCR00421152, Issue MSV-3731) is referenced in MediaTek's October 2025 security bulletin.
Local privilege escalation in MediaTek's WLAN AP driver allows an attacker who already holds System privilege to trigger an out-of-bounds stack write, potentially gaining higher-level code execution on affected devices. The flaw affects the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 builds that incorporate the vulnerable driver. No user interaction is required, but the attacker must first obtain System privileges, which limits the practical risk; no public exploit identified at time of analysis, and EPSS is low at 0.14% (3rd percentile).
Local privilege escalation in the MediaTek wlan AP driver lets an attacker who already holds System privilege trigger an out-of-bounds stack write through an incorrect bounds check, escalating to full confidentiality, integrity, and availability impact (CVSS 3.1 7.8, assessed vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) without any user interaction. Affected deployments include the MediaTek Software Development Kit and OpenWrt 19.07.0 and 21.02.0 builds that embed the vulnerable MediaTek wireless driver. No public exploit code or confirmed active exploitation has been identified (EPSS 0.14%, 3rd percentile), which is consistent with a second-stage escalation that requires a prior System-level compromise rather than an initial-access vector.
An out-of-bounds heap write in the MediaTek WLAN access-point driver lets an unauthenticated attacker inside wireless radio range execute code with the driver's privileges on affected devices. The flaw is reachable through malformed 802.11 frame handling in AP mode and requires no credentials and no user interaction, giving it a high 8.8 CVSS score; the practical barrier is physical proximity, since it is not exploitable over the general internet. Badly impacted builds include the MediaTek Software Development Kit and OpenWrt 21.02.0 and 23.05, and MediaTek has issued patch ID WCNCR00422323 via its October 2025 security bulletin; EPSS is low at 0.30% (20th percentile) and no public exploit has been identified at time of analysis.
An out-of-bounds write in the MediaTek WLAN access-point (AP) driver lets an unauthenticated attacker within wireless radio range corrupt memory and escalate privileges on affected access points. Exploitation requires the device to be running the vulnerable driver in AP mode - typically MediaTek SDK-based firmware or OpenWrt 19.07.0/21.02.0 images built for MediaTek Wi-Fi chipsets - and no user interaction or credentials are needed (PR:N/UI:N), though the attacker must be physically proximate (AV:A). The flaw has a public vendor fix (Patch ID WCNCR00422399, issue MSV-3748) and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, with EPSS sitting at a low 0.31% (22nd percentile), so risk is best characterized as technically serious but not yet broadly targeted.
Out-of-bounds write in MediaTek's WLAN access-point driver lets an attacker within wireless range corrupt memory and escalate privileges on the affected device, with no authentication or user interaction required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N, score 8.8). An integer overflow in the AP driver code path results in an out-of-bounds write that can yield high confidentiality, integrity, and availability impact on the open-source MediaTek software development kit and on OpenWrt releases 19.07.0 and 21.02.0, which ship the affected driver. Exploitability is bounded by radio proximity - the flaw is not internet-reachable - and there is no public exploit identified at time of analysis, with EPSS at 0.30% (20th percentile), indicating low near-term exploitation likelihood despite the high severity score. MediaTek has issued a fix (Patch ID WCNCR00418785) referenced in its October 2025 product security bulletin.
An out-of-bounds write in the MediaTek WLAN AP driver allows an attacker within wireless radio range of an affected access point to corrupt memory and escalate privileges without authentication or user interaction (CVSS 8.8, AV:A/AC:L/PR:N/UI:N, scope unchanged, high confidentiality, integrity, and availability impact). The root cause is an incorrect bounds check (CWE-120) applied to WLAN frames handled by the driver, affecting MediaTek SDK-based firmware as well as OpenWrt 19.07.0 and 21.02.0 builds that ship this driver. EPSS is low (0.31%, 22nd percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis, but because the flaw is reachable over the air with no credentials and no user action, exposed APs should be prioritized for patched firmware.
In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09741871; Issue ID: MSV-3317.
In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09752821; Issue ID: MSV-3342.
In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09812521; Issue ID: MSV-3421.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418040; Issue ID: MSV-3476.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418039; Issue ID: MSV-3477.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418038; Issue ID: MSV-3478.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418048; Issue ID: MSV-3479.
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418047; Issue ID: MSV-3480.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00415570; Issue ID: MSV-3404.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416226; Issue ID: MSV-3409.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416939; Issue ID: MSV-3422.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416938; Issue ID: MSV-3444.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416937; Issue ID: MSV-3445.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416936; Issue ID: MSV-3446.
Remote privilege escalation in Android WLAN AP driver via packet injection.
In wlan AP driver, there is a possible information disclosure due to an uncaught exception. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible information disclosure due to an uncaught exception. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In wlan AP FW, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In network HW, there is a possible system hang due to an uncaught exception. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible reachable assertion due to improper exception handling. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
In wlan STA FW, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan STA driver, there is a possible out of bounds write due to improper input validation. Rated high severity (CVSS 8.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Bluetooth firmware, there is a possible firmware asssert due to improper handling of exceptional conditions. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In wlan driver, there is a possible out of bound read due to improper input validation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan firmware, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan driver, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan driver, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan service, there is a possible out of bounds write due to improper input validation. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
In wlan driver, there is a possible out of bounds write due to improper input validation. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
In wlan driver, there is a possible out of bounds read due to improper input validation. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
In wlan driver, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In wlan service, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In wlan driver, there is a possible PIN crack due to use of insufficiently random values. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
matrix-android-sdk2 is the Matrix SDK for Android. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
matrix-android-sdk2 is the Matrix SDK for Android. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device management tools (Welch Allyn Service Tool:. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.