by Kastro
Paper/Archive/CVE-2024-20082

CVE-2024-20082

MediaTek, Inc. MT2735, MT2737, MT6833, MT6835, MT6835T, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983, MT6985, MT6989, MT6990 — In Modem, there is a possible memory corruption due to a missing bounds check.

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 71.8.718 × 2014.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01182594; Issue ID: MSV-1529.

Affected

ProductAffectedFixed inSource
MT2735, MT2737, MT6833, MT6835, MT6835T, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983, MT6985, MT6989, MT6990Modem NR15, NR16, NR17–CNA
mt2735≤ *–CISA-ADP
mt2737≤ *–CISA-ADP
mt6833≤ *–CISA-ADP
mt6835≤ *–CISA-ADP
mt6835t≤ *–CISA-ADP
mt6853≤ *–CISA-ADP
mt6855≤ *–CISA-ADP
mt6873≤ *–CISA-ADP
mt6875≤ *–CISA-ADP
mt6875t≤ *–CISA-ADP
mt6877≤ *–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcorp.mediatek.com/product-security-bulletin/August-2024