CVE-2025-20731
Full vulnerability record from the local CVENow database.
Description
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege (when OceReducedNeighborReport is disabled). User interaction is not needed for exploitation. Patch ID: WCNCR00441511; Issue ID: MSV-4140.
Severity
MEDIUM
CVSS score
5.3
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2025-11-04 07:15:37.117000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-20731",
"sourceIdentifier": "[email protected]",
"published": "2025-11-04T07:15:37.117",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege (when OceReducedNeighborReport is disabled). User interaction is not needed for exploitation. Patch ID: WCNCR00441511; Issue ID: MSV-4140."
},
{
"lang": "es",
"value": "En el controlador AP de WLAN, existe una posible escritura fuera de límites debido a una comprobación de límites incorrecta. Esto podría conducir a una escalada local de privilegios si un actor malicioso ya ha obtenido los privilegios del Sistema (cuando OceReducedNeighborReport está deshabilitado). No se necesita interacción del usuario para la explotación. ID del parche: WCNCR00441511; ID del problema: MSV-4140."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "MediaTek, Inc.",
"product": "MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT7981, MT7986",
"versions": [
{
"version": "SDK release 7.6.7.2 and before / openWRT 19.07, 21.02",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.8,
"impactScore": 3.4
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 0.8,
"impactScore": 3.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-11-05T04:55:49.944493Z",
"id": "CVE-2025-20731",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-122"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*",
"versionEndIncluding": "7.6.7.2",
"matchCriteriaId": "0DD86CC1-BD46-42D2-9112-190CCAC96B30"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:*",
"matchCriteriaId": "4FA469E2-9E63-4C9A-8EBA-10C8C870063A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*",
"matchCriteriaId": "F0133207-2EED-4625-854F-8DB7770D5BF7"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*",
"matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:mediatek:mt7615:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05748BB1-0D48-4097-932E-E8E2E574FD8D"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:mediatek:mt7622:-:*:*:*:*:*:*:*",
"matchCriteriaId": "55EB4B27-6264-45BE-9A22-BE8418BB0C06"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:mediatek:mt7663:-:*:*:*:*:*:*:*",
"matchCriteriaId": "10C79211-F064-499D-914E-0BACD038FBF4"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3AB22996-9C22-4B6C-9E94-E4C055D16335"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD5AA441-5381-4179-89EB-1642120F72B4"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*",
"matchCriteriaId": "490CD97B-021F-4350-AEE7-A2FA866D5889"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*",
"matchCriteriaId": "40A9E917-4B34-403F-B512-09EEBEA46811"
}
]
}
]
}
],
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}