CVE-2022-32663
Published: 06 February 2023
Summary
CVE-2022-32663 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Mediatek Mt5221 Firmware. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-32663 is a null pointer dereference vulnerability in the Wi-Fi driver that can trigger a system crash. The flaw is tracked under CWE-476 and carries a CVSS 3.1 score of 7.5, reflecting a remotely exploitable denial-of-service condition without any confidentiality or integrity impact.
An unauthenticated network attacker can send specially crafted Wi-Fi frames that reach the affected driver, causing an immediate kernel-level crash. No user interaction or additional execution privileges are required, allowing the attack to be launched from adjacent or remote network positions depending on wireless exposure.
MediaTek’s February 2023 security bulletin lists the issue under Patch ID GN20220720014 and directs vendors to apply the corresponding driver update that resolves the null dereference.
EPSS for the CVE rose from a low baseline to a recorded peak of 0.0523 on 2025-12-11 before receding to the current value of 0.0120, indicating a measurable increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35729
Vulnerability details
In Wi-Fi driver, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN20220720014; Issue ID:…
more
GN20220720014.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.