CVE-2025-20633
Published: 03 February 2025
Summary
CVE-2025-20633 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Mediatek Software Development Kit. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 46.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the out-of-bounds write vulnerability in the WLAN AP driver by requiring timely application of the vendor patch WCNCR00400889.
Requires validation of information inputs to the WLAN driver, directly addressing the incorrect bounds check that enables the out-of-bounds write.
Implements memory protection mechanisms that prevent arbitrary code execution from out-of-bounds writes in the WLAN AP driver.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in WLAN AP driver directly enables remote code execution over adjacent network without auth, mapping to exploitation of remote services.
NVD Description
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch…
more
ID: WCNCR00400889; Issue ID: MSV-2491.
Deeper analysisAI
CVE-2025-20633 is a high-severity vulnerability in the WLAN Access Point (AP) driver, stemming from an incorrect bounds check that enables an out-of-bounds write. This flaw affects MediaTek's WLAN AP driver components, as detailed in their product security bulletin. Classified under CWE-787 (Out-of-bounds Write), it carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating significant impact potential.
An attacker positioned in the adjacent or proximal network segment (AV:A) can exploit this vulnerability remotely with low complexity, requiring no privileges (PR:N) or user interaction (UI:N). Successful exploitation leads to arbitrary code execution, granting high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) without scope changes.
MediaTek's February 2025 Product Security Bulletin addresses the issue, providing Patch ID WCNCR00400889 for remediation. Affected vendors and device manufacturers should apply this patch to mitigate the risk of adjacent-network code execution.
Details
- CWE(s)