{"api_version":"1","generated_at":"2026-10-21T21:27:29+00:00","cve":"CVE-2025-20712","urls":{"html":"https://cve.report/CVE-2025-20712","api":"https://cve.report/api/cve/CVE-2025-20712.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-20712","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-20712"},"summary":{"title":"CVE-2025-20712","description":"In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422323; Issue ID: MSV-3810.","state":"PUBLISHED","assigner":"MediaTek","published_at":"2025-10-14 10:15:35","updated_at":"2026-10-08 12:10:00"},"problem_types":["CWE-122","CWE-122 CWE-122 Heap Overflow"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://corp.mediatek.com/product-security-bulletin/October-2025","name":"https://corp.mediatek.com/product-security-bulletin/October-2025","refsource":"security@mediatek.com","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-20712","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20712","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MT6990, MT7990, MT7991, MT7992, MT7993","version":"affected SDK release 8.3.1.1 and before / OpenWrt 21.02, 23.05 (MT6990)","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"20712","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"mediatek","cpe5":"mt6990","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"20712","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"mediatek","cpe5":"mt7990","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"20712","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"mediatek","cpe5":"mt7991","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"20712","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"mediatek","cpe5":"mt7992","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"20712","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"mediatek","cpe5":"mt7993","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"20712","vulnerable":"1","versionEndIncluding":"8.3.1.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediatek","cpe5":"software_development_kit","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"20712","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"openwrt","cpe5":"openwrt","cpe6":"21.02.0","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"20712","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"openwrt","cpe5":"openwrt","cpe6":"23.05","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2025-20712","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-10-15T03:56:25.613107Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-02-26T17:47:43.510Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"MT6990, MT7990, MT7991, MT7992, MT7993","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"SDK release 8.3.1.1 and before / OpenWrt 21.02, 23.05 (MT6990)"}]}],"descriptions":[{"lang":"en","value":"In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422323; Issue ID: MSV-3810."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","description":"CWE-122 Heap Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-14T09:11:30.703Z","orgId":"ee979b05-11f8-4f25-a7e0-a1fa9c190374","shortName":"MediaTek"},"references":[{"url":"https://corp.mediatek.com/product-security-bulletin/October-2025"}]}},"cveMetadata":{"assignerOrgId":"ee979b05-11f8-4f25-a7e0-a1fa9c190374","assignerShortName":"MediaTek","cveId":"CVE-2025-20712","datePublished":"2025-10-14T09:11:30.703Z","dateReserved":"2024-11-01T01:21:50.385Z","dateUpdated":"2026-02-26T17:47:43.510Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-10-14 10:15:35","lastModifiedDate":"2026-10-08 12:10:00","problem_types":["CWE-122","CWE-122 CWE-122 Heap Overflow"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-15T03:56:25.613107Z","id":"CVE-2025-20712","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*","versionEndIncluding":"8.3.1.1","matchCriteriaId":"A9C88907-D089-41BA-8B9D-62FC354C5638"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"},{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt7990:-:*:*:*:*:*:*:*","matchCriteriaId":"4901B2A5-B0C8-4A0C-AC17-87D469744817"},{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt7991:-:*:*:*:*:*:*:*","matchCriteriaId":"8E9E54EE-F657-4B42-B1DA-CD00132FB4AC"},{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt7992:-:*:*:*:*:*:*:*","matchCriteriaId":"50D01D7D-A88D-471D-A23A-42AF4DF82952"},{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt7993:-:*:*:*:*:*:*:*","matchCriteriaId":"76653163-7627-4C63-A5E2-6277C0EFE23E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*","matchCriteriaId":"F0133207-2EED-4625-854F-8DB7770D5BF7"},{"vulnerable":true,"criteria":"cpe:2.3:o:openwrt:openwrt:23.05:*:*:*:*:*:*:*","matchCriteriaId":"AED95D06-8EC6-4070-BE3C-E0F851D7FFC1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"20712","Ordinal":"1","Title":"CVE-2025-20712","CVE":"CVE-2025-20712","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"20712","Ordinal":"1","NoteData":"In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422323; Issue ID: MSV-3810.","Type":"Description","Title":"CVE-2025-20712"}]}}}