CVE-2024-20017

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-20017
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.
CVSS

No CVSS.

References
Link Resource
https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html Exploit Technical Description Third Party Advisory
https://blog.sonicwall.com/en-us/2024/09/critical-exploit-in-mediatek-wi-fi-chipsets-zero-click-vulnerability-cve-2024-20017-threatens-routers-and-smartphones/ Exploit Third Party Advisory
https://corp.mediatek.com/product-security-bulletin/March-2024 Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/March-2024 Vendor Advisory
https://news.ycombinator.com/item?id=41605680 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*
OR cpe:2.3:h:mediatek:mt7622:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*
OR cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:*
cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*
History

05 May 2025, 17:48

Type Values Removed Values Added
CPE cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:*
cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*
cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7622:-:*:*:*:*:*:*:*
cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*
References
  • () https://news.ycombinator.com/item?id=41605680 - Third Party Advisory
  • () https://blog.sonicwall.com/en-us/2024/09/critical-exploit-in-mediatek-wi-fi-chipsets-zero-click-vulnerability-cve-2024-20017-threatens-routers-and-smartphones/ - Exploit, Third Party Advisory
  • () https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html - Exploit, Technical Description, Third Party Advisory
References () https://corp.mediatek.com/product-security-bulletin/March-2024 - () https://corp.mediatek.com/product-security-bulletin/March-2024 - Vendor Advisory
First Time Openwrt openwrt
Mediatek mt6890
Mediatek mt7916
Openwrt
Mediatek software Development Kit
Mediatek mt7981
Mediatek mt7622
Mediatek mt7915
Mediatek
Mediatek mt7986

07 Mar 2024, 03:15

Type Values Removed Values Added
Summary In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132. In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.

04 Mar 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-04 03:15

Updated : 2025-05-05 17:48

NVD link : CVE-2024-20017

Mitre link : CVE-2024-20017

JSON object : View

Products Affected

mediatek

  • mt7916
  • mt6890
  • mt7986
  • software_development_kit
  • mt7981
  • mt7622
  • mt7915

openwrt

  • openwrt
CWE

No CWE.