CVE-2025-20654

critical · 9.8

In wlan service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00406897; Issue ID: MSV-2875.

9.8

CVSS

0.8%

EPSS (exploit prob.)

55th

EPSS percentile

2025-04-07

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-787

Affected products

Vendor	Product	Affected versions
mediatek	software_development_kit	<= 7.4.0.1
mediatek	mt7622	all versions
mediatek	mt7915	all versions
mediatek	software_development_kit	<= 7.6.7.0
mediatek	mt7915	all versions
mediatek	mt7916	all versions
mediatek	mt7981	all versions
mediatek	mt7986	all versions
openwrt	openwrt	19.07.0
openwrt	openwrt	21.02.0
mediatek	mt6890	all versions

Check a specific version with /api/v1/cve/match.

References

https://corp.mediatek.com/product-security-bulletin/April-2025

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-20654