PT-2021-5744 · Mediatek · Mediatek Microchips

Published 2021-12-25 · Updated 2022-01-10 · CVE-2021-37562

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions MediaTek microchips versions MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915 Affected Software Versions 7.4.0.0

Description The issue is related to an out-of-bounds read in the memory of MediaTek microchips, which can be exploited by a remote attacker to cause a denial of service. The vulnerability is due to the mishandling of the WPS (Wi-Fi Protected Setup) protocol.

Recommendations For versions MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915, consider disabling the WPS protocol until a patch is available. As a temporary workaround, restrict access to the WPS protocol to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-00187

CVE-2021-37562

Affected Products

Mediatek Microchips

References · 7

• https://corp.mediatek.com/product-security-bulletin/January-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37562 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00187 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37562 · Security Note
• https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300 · Note
• https://t.me/cibsecurity/34613 · Telegram Post
• https://t.me/cvenotify/24918 · Telegram Post