PT-2025-23450 · Mediatek +2 · Mt6890 +16

Published 2025-06-01 · Updated 2025-07-18 · CVE-2025-20674

Positive Technologies · (AI Summary)

CVSS v2.0

10

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions:

The product name cannot be determined.

Description:

A missing permission check in the wlan AP driver allows for the injection of arbitrary packets, potentially leading to remote escalation of privilege without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-06487

CVE-2025-20674

Affected Products

Mt6890

Mt7915

Mt7916

Mt7981

Mt7986

Mt7990

Mt7992

Mt7993

Openwrt

Mt7915 Firmware

Mt7916 Firmware

Mt7981 Firmware

Mt7986 Firmware

Mt7990 Firmware

Mt7992 Firmware

Mt7993 Firmware

Software Development Kit

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-20674 · Security Note
• https://bdu.fstec.ru/vul/2025-06487 · Security Note
• https://corp.mediatek.com/product-security-bulletin/June-2025 · Vendor Advisory
• https://twitter.com/transilienceai/status/1929507269890261011 · Twitter Post
• https://t.me/latest_high_impact_cve/2521 · Telegram Post
• https://t.me/cvenotify/129473 · Telegram Post
• https://twitter.com/cracbot/status/1931305170702360909 · Twitter Post
• https://twitter.com/cracbot/status/1930580431549661211 · Twitter Post
• https://t.me/cvenotify/124289 · Telegram Post
• https://t.me/cvetracker/25121 · Telegram Post
• https://t.me/cvenotify/127414 · Telegram Post