PT-2023-7917 · Mediatek · Mediatek 5G Modules

CVE-2023-20702 · Publicado 2023-11-05 · Atualizado 2024-09-05

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MediaTek 5G modules (affected versions not specified)

Description The issue is related to insufficient input validation in MediaTek 5G wireless communication modules, which can lead to a denial of service. In the 5G NRLC, there is a possible invalid memory access due to lack of error handling. This could lead to remote denial of service if a UE received an invalid 1-byte RLC SDU, with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Resource Release

Enumeração de Fraquezas

CWE-404

Identificadores relacionados

BDU:2023-08992

CVE-2023-20702

Produtos afetados

Mediatek 5G Modules

Referências · 6

• https://corp.mediatek.com/product-security-bulletin/November-2023 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-08992 · Nota de Segurança
• https://t.me/cibsecurity/73566 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-20702 · Nota de Segurança
• https://t.me/true_secator/5188 · Publicação no Telegram
• https://t.me/cvenotify/93407 · Publicação no Telegram