Out of Bounds Write Vulnerability in MediaTek WLAN AP Driver
CVE-2025-20748

6.7MEDIUM

Key Information:

Vendor

MediaTek
Status
Mt6890, Mt7615, Mt7622, Mt7663, Mt7915, Mt7916, Mt7981, Mt7986
Vendor
CVE Published:
4 November 2025

What is CVE-2025-20748?

The vulnerability in the WLAN AP driver of MediaTek products exposes users to the risk of local privilege escalation due to a flawed bounds check. When exploited, this flaw allows an attacker with system-level access to write to memory locations outside the intended boundaries, potentially compromising system integrity without requiring user interaction. A fix has been initiated, and users are advised to apply the patch to mitigate risks. Continuous monitoring and updates are crucial to maintaining security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT7981, MT7986 SDK release 7.6.7.2 and before / openWRT 19.07, 21.02

References

https://corp.mediatek.com/product-security-bulletin/Novem...

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.