Out of Bounds Write Vulnerability in MediaTek WLAN AP Firmware
CVE-2026-20430

8.8HIGH

Key Information:

Vendor

MediaTek
Status
Mt6890, Mt7915, Mt7916, Mt7981, Mt7986
Vendor
CVE Published:
2 March 2026

What is CVE-2026-20430?

An out of bounds write vulnerability has been identified in the firmware of MediaTek WLAN access points. This issue arises from an incorrect bounds check, allowing a remote attacker (proximal or adjacent) to escalate privileges without requiring any additional execution rights. The vulnerability does not necessitate user interaction, which increases the risk of exploitation. MediaTek has provided a patch (ID: WCNCR00467553) to address this issue, and it is crucial for users to update their devices to safeguard against potential threats.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MT6890, MT7915, MT7916, MT7981, MT7986 SDK release 7.6.7.3 and before / openWRT 19.07, 21.02, 23.05

References

https://corp.mediatek.com/product-security-bulletin/March...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.