Critical severity · published Apr 7, 2025
CVE-2025-20654
In wlan service, there is a possible out of bounds write due to an incorrect bounds check
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00406897; Issue ID: MSV-2875.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
Mt6890 · Mediatek
All versions, or not specified · source: NVD
MT
Mt7622 · Mediatek
All versions, or not specified · source: NVD
MT
Mt7915 · Mediatek
All versions, or not specified · source: NVD
MT
Mt7916 · Mediatek
All versions, or not specified · source: NVD
MT
Mt7981 · Mediatek
All versions, or not specified · source: NVD
MT
Mt7986 · Mediatek
All versions, or not specified · source: NVD
OP
Openwrt · Openwrt
19.07.0; 21.02.0 · source: NVD
SD
Software Development Kit · Mediatek
through 7.4.0.1; through 7.6.7.0 · source: NVD