CVE-2024-20138

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-20138

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

I

n wlan driver, there is a possible out of bound read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08998291; Issue ID: MSV-1604.

References
Link Resource
https://corp.mediatek.com/product-security-bulletin/December-2024 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
OR cpe:2.3:h:mediatek:mt3605:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7925:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7927:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*
History

22 Apr 2025, 13:49

Type Values Removed Values Added
First Time Mediatek mt8390
Mediatek mt7925
Mediatek mt6985
Google
Mediatek mt3605
Mediatek mt6989
Mediatek software Development Kit
Mediatek mt8195
Mediatek mt6990
Mediatek mt7927
Mediatek mt8370
Google android
Mediatek
References () https://corp.mediatek.com/product-security-bulletin/December-2024 - () https://corp.mediatek.com/product-security-bulletin/December-2024 - Vendor Advisory
CPE cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7925:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt3605:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt7927:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*
cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*

02 Dec 2024, 16:15

Type Values Removed Values Added
Summary
  • (es) En el controlador WLAN, existe una posible lectura fuera de los límites debido a una validación de entrada incorrecta. Esto podría provocar la divulgación de información remota sin necesidad de privilegios de ejecución adicionales. No se necesita interacción del usuario para la explotación. ID de parche: ALPS08998291; ID de problema: MSV-1604.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

02 Dec 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-02 04:15

Updated : 2025-04-22 13:49

NVD link : CVE-2024-20138

Mitre link : CVE-2024-20138

CVE.ORG link : CVE-2024-20138

JSON object : View

Products Affected

mediatek

google

CWE
CWE-125

Out-of-bounds Read