CVE-2024-20150
Published: 06 January 2025
Summary
CVE-2024-20150 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Mediatek Lr12A. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of known flaws like this modem logic error via patches such as MOLY01412526 to prevent remote DoS exploitation.
Implements protections specifically against denial-of-service attacks that cause system crashes from remote network access to the vulnerable modem component.
Validates untrusted network inputs to the modem to block malformed data triggering the deserialization-related logic error (CWE-502).
NVD Description
In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01412526; Issue ID: MSV-2018.
Deeper analysisAI
CVE-2024-20150 is a logic error vulnerability in the Modem component of MediaTek products, which can cause a system crash. Published on January 6, 2025, it is tracked with Patch ID MOLY01412526 and Issue ID MSV-2018, and is associated with CWE-502 (Deserialization of Untrusted Data). The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no confidentiality or integrity effects.
Remote attackers can exploit this vulnerability without authentication or user interaction, requiring only network access and low complexity. Successful exploitation leads to a denial of service via system crash, with no additional execution privileges needed.
MediaTek's January 2025 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/January-2025 provides details on the issue, including the associated patch MOLY01412526 for mitigation. Security practitioners should apply the relevant firmware updates to affected devices.
Details
- CWE(s)