PT-2021-5740 · Mediatek · Mediatek Microchips

Published 2021-11-23 · Updated 2022-01-10 · CVE-2021-37566

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MediaTek microchips versions 2.0.2 MT7603E, MT7610, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915

Description The issue is related to the mishandling of IEEE 1905 protocols, which can lead to an out-of-bounds write in memory. This can allow a remote attacker to elevate their privileges. The estimated number of potentially affected devices is not specified.

Recommendations For version 2.0.2, update to a newer version to mitigate the risk. For MT7603E, MT7610, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915, consider disabling the IEEE 1905 protocol handling until a patch is available. Restrict access to the vulnerable microchips to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-00183

CVE-2021-37566

Affected Products

Mediatek Microchips

References · 11

• https://corp.mediatek.com/product-security-bulletin/January-2022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37566 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37566 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00183 · Security Note
• https://t.me/cibsecurity/34621 · Telegram Post
• https://t.me/pentestingnews/14531 · Telegram Post
• https://t.me/cvenotify/25030 · Telegram Post
• https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300 · Note
• https://t.me/cvenotify/24914 · Telegram Post
• https://t.me/cvenotify/24994 · Telegram Post
• https://t.me/cybersecuritytechnologies/4816 · Telegram Post