CVE-2024-20137
Published: 02 December 2024
Summary
CVE-2024-20137 is a high-severity Uncaught Exception (CWE-248) vulnerability in Mediatek (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
In the MediaTek wlan driver, CVE-2024-20137 arises from improper handling of exceptional conditions that can trigger client disconnection. The flaw is tracked under CWE-248 and carries a CVSS 3.1 score of 7.5, reflecting network attack vectors with low complexity and no required privileges or user interaction. It affects wireless LAN components in MediaTek chipsets and is addressed by patch ID WCNCR00384543 for issue MSV-1727.
An unauthenticated remote attacker can send crafted network traffic that exploits the exception-handling weakness, forcing connected clients to disconnect and thereby producing a denial-of-service condition without any further execution rights on the target system.
MediaTek’s December 2024 product security bulletin lists the issue and directs users to apply the referenced patch to resolve the driver-level flaw.
The associated EPSS score has remained flat at 0.1007 with no material increase since disclosure, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-17852
Vulnerability details
In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00384543;…
more
Issue ID: MSV-1727.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.