PT-2021-5737 · Mediatek · Mt7628+9

Published 2021-12-25 · Updated 2022-01-10 · CVE-2021-32467

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions MediaTek microchips versions MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915 Affected Software Versions 7.4.0.0

Description The issue is related to the mishandling of the WPS (Wi-Fi Protected Setup) protocol, which can lead to an out-of-bounds read in memory. This can allow a remote attacker to cause a denial of service. The estimated number of potentially affected devices is not specified.

Recommendations For versions MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915, consider disabling the WPS protocol until a patch is available. For version 7.4.0.0, update to a newer version that handles the WPS protocol correctly. As a temporary workaround, restrict access to the WPS protocol to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-00180

CVE-2021-32467

Affected Products

Mt7603E

Mt7610

Mt7612

Mt7613

Mt7615

Mt7620

Mt7622

Mt7628

Mt7629

Mt7915

References · 7

• https://bdu.fstec.ru/vul/2022-00180 · Security Note
• https://corp.mediatek.com/product-security-bulletin/January-2022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32467 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32467 · Vendor Advisory
• https://t.me/cibsecurity/34625 · Telegram Post
• https://t.me/cvenotify/24924 · Telegram Post
• https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300 · Note