PT-2021-5734 · Mediatek · Mt7628+9

Published 2021-12-25 · Updated 2022-01-10 · CVE-2021-37560

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MediaTek microchips versions MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915 Affected Software Versions 7.4.0.0

Description The issue is related to a buffer out-of-bounds write in the memory of MediaTek microchips, which can be exploited by a remote attacker to elevate their privileges. The vulnerability is caused by the mishandling of the WPS (Wi-Fi Protected Setup) protocol.

Recommendations For versions MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915, consider disabling the WPS protocol until a patch is available. As a temporary workaround, restrict access to the WPS protocol to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-00177

CVE-2021-37560

Affected Products

Mt7603E

Mt7610

Mt7612

Mt7613

Mt7615

Mt7620

Mt7622

Mt7628

Mt7629

Mt7915

References · 8

• https://corp.mediatek.com/product-security-bulletin/January-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37560 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00177 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37560 · Security Note
• https://t.me/cvenotify/25180 · Telegram Post
• https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300 · Note
• https://t.me/cibsecurity/34610 · Telegram Post
• https://t.me/cvenotify/24920 · Telegram Post