PT-2023-7917 · Mediatek · Mediatek 5G Modules

Published 2023-11-05 · Updated 2024-09-05 · CVE-2023-20702

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MediaTek 5G modules (affected versions not specified)

Description The issue is related to insufficient input validation in MediaTek 5G wireless communication modules, which can lead to a denial of service. In the 5G NRLC, there is a possible invalid memory access due to lack of error handling. This could lead to remote denial of service if a UE received an invalid 1-byte RLC SDU, with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2023-08992

CVE-2023-20702

Affected Products

Mediatek 5G Modules

References · 6

• https://corp.mediatek.com/product-security-bulletin/November-2023 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08992 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20702 · Security Note
• https://t.me/cibsecurity/73566 · Telegram Post
• https://t.me/true_secator/5188 · Telegram Post
• https://t.me/cvenotify/93407 · Telegram Post