Remote Privilege Escalation Vulnerability in Mediatek WLAN AP Driver
CVE-2025-20674

9.8CRITICAL

Key Information:

Vendor

MediaTek
Status
Mt6890, Mt6990, Mt7915, Mt7916, Mt7981, Mt7986, Mt7990, Mt7992, Mt7993
Vendor
CVE Published:
2 June 2025

What is CVE-2025-20674?

A vulnerability in the Mediatek WLAN AP driver allows for arbitrary packet injection due to a missing permission check. This flaw can lead to remote privilege escalation without the need for additional execution privileges or user interaction. Affected users should apply the patch identified as WCNCR00413202 to mitigate this issue. For detailed information, refer to the Mediatek security bulletin.

Affected Version(s)

MT6890, MT6990, MT7915, MT7916, MT7981, MT7986, MT7990, MT7992, MT7993 SDK release 7.6.7.2 and before / OpenWrt 19.07, 21.02 (MT6890) / OpenWrt 21.02, 23.05 (MT6990)

References

https://corp.mediatek.com/product-security-bulletin/June-...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-20674 : Remote Privilege Escalation Vulnerability in Mediatek WLAN AP Driver