PT-2021-5730 · Mediatek · Mediatek Microchips

Published 2021-11-23 · Updated 2022-01-06 · CVE-2021-37572

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AC:L/AV:N/A:L/C:H/I:N/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions MediaTek microchips versions 2.0.2 MT7603E, MT7613, MT7615, MT7622, MT7628, MT7629, MT7915

Description The issue is related to the mishandling of IEEE 1905 protocols and the lack of authorization in the daemon of MediaTek microchips. This can allow a remote attacker to cause a denial of service.

Recommendations For version 2.0.2, update to a newer version that addresses the authorization issue in the handling of IEEE 1905 protocols. For MT7603E, MT7613, MT7615, MT7622, MT7628, MT7629, MT7915, consider disabling the IEEE 1905 protocol handling until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2022-00173

CVE-2021-37572

Affected Products

Mediatek Microchips

References · 10

• https://bdu.fstec.ru/vul/2022-00173 · Security Note
• https://corp.mediatek.com/product-security-bulletin/January-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37572 · Security Note
• https://t.me/pentestingnews/14531 · Telegram Post
• https://t.me/cvenotify/24908 · Telegram Post
• https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300 · Note
• https://t.me/cvenotify/24988 · Telegram Post
• https://t.me/cibsecurity/34620 · Telegram Post
• https://t.me/cybersecuritytechnologies/4816 · Telegram Post