CVE-2024-20107 | ByteOS Network

Vulnerability Details :

CVE-2024-20107

Assigner-MediaTek

Assigner Org ID-ee979b05-11f8-4f25-a7e0-a1fa9c190374

Published At-04 Nov, 2024 | 01:48

Updated At-04 Nov, 2024 | 10:56

In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09124360; Issue ID: MSV-1823.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:MediaTek

Assigner Org ID:ee979b05-11f8-4f25-a7e0-a1fa9c190374

Published At:04 Nov, 2024 | 01:48

Updated At:04 Nov, 2024 | 10:56

▼CVE Numbering Authority (CNA)

In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09124360; Issue ID: MSV-1823.

Affected Products

Vendor

Product

MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT6880, MT6886, MT6890, MT6895, MT6897, MT6980, MT6983, MT6985, MT6989, MT6990, MT8188, MT8370, MT8390, MT8676

Versions

Affected

Android 12.0, 13.0, 14.0, 15.0 / openWRT 19.07, 21.02, 23.05 / Yocto 4.0 / RDK-B 22Q3, 24Q1

Problem Types

Type	CWE ID	Description
CWE	CWE-125	CWE-125 Out-of-bounds Read

Type: CWE

CWE ID: CWE-125

Description: CWE-125 Out-of-bounds Read

References

Hyperlink	Resource
https://corp.mediatek.com/product-security-bulletin/November-2024	N/A

Hyperlink: https://corp.mediatek.com/product-security-bulletin/November-2024

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics

Version	Base score	Base severity	Vector
3.1	6.2	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Version: 3.1

Base score: 6.2

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:security@mediatek.com

Published At:04 Nov, 2024 | 02:15

Updated At:24 Apr, 2025 | 15:04

In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09124360; Issue ID: MSV-1823.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.2	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 6.2

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CPE Matches

The Linux Foundation

>>yocto>>4.0

cpe:2.3:a:linuxfoundation:yocto:4.0:*:*:*:*:*:*:*

rdkcentral>>rdk-b>>2022q3

cpe:2.3:a:rdkcentral:rdk-b:2022q3:*:*:*:*:*:*:*

rdkcentral>>rdk-b>>2024q1

cpe:2.3:a:rdkcentral:rdk-b:2024q1:*:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*

>>android>>13.0

cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*

>>android>>14.0

cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*

>>android>>15.0

cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*

>>openwrt>>19.07.0

cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:*

>>openwrt>>21.02.0

cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*

>>openwrt>>23.05

cpe:2.3:o:openwrt:openwrt:23.05:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-125	Secondary	security@mediatek.com
CWE-125	Primary	nvd@nist.gov

CWE ID: CWE-125

Type: Secondary

Source: security@mediatek.com

CWE ID: CWE-125

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://corp.mediatek.com/product-security-bulletin/November-2024	security@mediatek.com	Vendor Advisory

Hyperlink: https://corp.mediatek.com/product-security-bulletin/November-2024

Source: security@mediatek.com

Resource:

Vendor Advisory