PT-2021-5742 · Mediatek · Mediatek Microchips

Published 2021-11-23 · Updated 2022-01-10 · CVE-2021-35055

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MediaTek microchips versions MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915 Affected Software Versions 7.4.0.0

Description The issue is related to a buffer out-of-bounds write in the memory of MediaTek microchips, which can be exploited by a remote attacker to elevate their privileges. The vulnerability is caused by the mishandling of the WPS (Wi-Fi Protected Setup) protocol.

Recommendations For versions MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915, consider disabling the WPS protocol until a patch is available. For version 7.4.0.0, update to a newer version that addresses the out-of-bounds write issue. As a temporary workaround, restrict access to the WPS protocol to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-00185

CVE-2021-35055

Affected Products

Mediatek Microchips

References · 10

• https://corp.mediatek.com/product-security-bulletin/January-2022 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00185 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35055 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35055 · Security Note
• https://t.me/cvenotify/25177 · Telegram Post
• https://t.me/pentestingnews/14531 · Telegram Post
• https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300 · Note
• https://t.me/cvenotify/24921 · Telegram Post
• https://t.me/cybersecuritytechnologies/4816 · Telegram Post
• https://t.me/cibsecurity/34619 · Telegram Post