Multiple vulnerabilities in MediaTek chipsets



| Updated: 2023-03-07
Risk Medium
Patch available YES
Number of vulnerabilities 18
CVE-ID CVE-2022-21755
CVE-2022-21762
CVE-2022-21761
CVE-2022-21760
CVE-2022-21759
CVE-2022-21758
CVE-2022-21757
CVE-2022-21756
CVE-2022-21754
CVE-2022-21745
CVE-2022-21753
CVE-2022-21752
CVE-2022-21751
CVE-2022-21750
CVE-2022-21749
CVE-2022-21748
CVE-2022-21747
CVE-2022-21746
CWE-ID CWE-20
CWE-190
CWE-120
CWE-415
CWE-400
CWE-416
CWE-284
Exploitation vector Local network
Public exploit N/A
Vulnerable software
 MT6731
Mobile applications / Mobile firmware & hardware

MT6732
Mobile applications / Mobile firmware & hardware

MT6735
Mobile applications / Mobile firmware & hardware

MT6737
Mobile applications / Mobile firmware & hardware

MT6739
Mobile applications / Mobile firmware & hardware

MT6750
Mobile applications / Mobile firmware & hardware

MT6750S
Mobile applications / Mobile firmware & hardware

MT6752
Mobile applications / Mobile firmware & hardware

MT6753
Mobile applications / Mobile firmware & hardware

MT6755
Mobile applications / Mobile firmware & hardware

MT6755S
Mobile applications / Mobile firmware & hardware

MT6757
Mobile applications / Mobile firmware & hardware

MT6757C
Mobile applications / Mobile firmware & hardware

MT6757CD
Mobile applications / Mobile firmware & hardware

MT6757CH
Mobile applications / Mobile firmware & hardware

MT6758
Mobile applications / Mobile firmware & hardware

MT6761
Mobile applications / Mobile firmware & hardware

MT6762
Mobile applications / Mobile firmware & hardware

MT6763
Mobile applications / Mobile firmware & hardware

MT6765
Mobile applications / Mobile firmware & hardware

MT6768
Mobile applications / Mobile firmware & hardware

MT6769
Mobile applications / Mobile firmware & hardware

MT6771
Mobile applications / Mobile firmware & hardware

MT6789
Mobile applications / Mobile firmware & hardware

MT6795
Mobile applications / Mobile firmware & hardware

MT6797
Mobile applications / Mobile firmware & hardware

MT6799
Mobile applications / Mobile firmware & hardware

MT6833
Mobile applications / Mobile firmware & hardware

MT6879
Mobile applications / Mobile firmware & hardware

MT6880
Mobile applications / Mobile firmware & hardware

MT6890
Mobile applications / Mobile firmware & hardware

MT6895
Mobile applications / Mobile firmware & hardware

MT8167S
Mobile applications / Mobile firmware & hardware

MT8168
Mobile applications / Mobile firmware & hardware

MT8175
Mobile applications / Mobile firmware & hardware

MT8183
Mobile applications / Mobile firmware & hardware

MT8185
Mobile applications / Mobile firmware & hardware

MT8362A
Mobile applications / Mobile firmware & hardware

MT8365
Mobile applications / Mobile firmware & hardware

MT8385
Mobile applications / Mobile firmware & hardware

MT8667
Mobile applications / Mobile firmware & hardware

MT8675
Mobile applications / Mobile firmware & hardware

MT8695
Mobile applications / Mobile firmware & hardware

MT8696
Mobile applications / Mobile firmware & hardware

MT8766
Mobile applications / Mobile firmware & hardware

MT8768
Mobile applications / Mobile firmware & hardware

MT8786
Mobile applications / Mobile firmware & hardware

MT8788
Mobile applications / Mobile firmware & hardware

MT8789
Mobile applications / Mobile firmware & hardware

MT9636
Mobile applications / Mobile firmware & hardware

MT9638
Mobile applications / Mobile firmware & hardware

MT9666
Mobile applications / Mobile firmware & hardware

MT6580
Mobile applications / Mobile firmware & hardware

MT6983
Mobile applications / Mobile firmware & hardware

MT8167
Mobile applications / Mobile firmware & hardware

MT8173
Mobile applications / Mobile firmware & hardware

MT8321
Mobile applications / Mobile firmware & hardware

MT8666
Mobile applications / Mobile firmware & hardware

MT8765
Mobile applications / Mobile firmware & hardware

MT8791
Mobile applications / Mobile firmware & hardware

MT6985
Mobile applications / Mobile firmware & hardware

MT6779
Hardware solutions / Firmware

MT6781
Hardware solutions / Firmware

MT6785
Hardware solutions / Firmware

MT6853
Hardware solutions / Firmware

MT6853T
Hardware solutions / Firmware

MT6873
Hardware solutions / Firmware

MT6875
Hardware solutions / Firmware

MT6877
Hardware solutions / Firmware

MT6883
Hardware solutions / Firmware

MT6885
Hardware solutions / Firmware

MT6889
Hardware solutions / Firmware

MT6891
Hardware solutions / Firmware

MT6893
Hardware solutions / Firmware

MT8797
Hardware solutions / Firmware

Vendor MediaTek

Security Bulletin

This security bulletin contains information about 18 vulnerabilities.

1) Improper Input Validation

EUVDB-ID: #VU73093

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21755

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local privileged application to gain access to sensitive information.

The vulnerability exists due to an incorrect bounds check within WLAN driver. A local privileged application can gain access to sensitive information.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6731: All versions

MT6732: All versions

MT6735: All versions

MT6737: All versions

MT6739: All versions

MT6750: All versions

MT6750S: All versions

MT6752: All versions

MT6753: All versions

MT6755: All versions

MT6755S: All versions

MT6757: All versions

MT6757C: All versions

MT6757CD: All versions

MT6757CH: All versions

MT6758: All versions

MT6761: All versions

MT6762: All versions

MT6763: All versions

MT6765: All versions

MT6768: All versions

MT6769: All versions

MT6771: All versions

MT6779: All versions

MT6781: All versions

MT6785: All versions

MT6789: All versions

MT6795: All versions

MT6797: All versions

MT6799: All versions

MT6833: All versions

MT6853: All versions

MT6853T: All versions

MT6873: All versions

MT6875: All versions

MT6877: All versions

MT6879: All versions

MT6880: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6890: All versions

MT6891: All versions

MT6893: All versions

MT6895: All versions

MT8167S: All versions

MT8168: All versions

MT8175: All versions

MT8183: All versions

MT8185: All versions

MT8362A: All versions

MT8365: All versions

MT8385: All versions

MT8667: All versions

MT8675: All versions

MT8695: All versions

MT8696: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU73100

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21762

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local privileged application to perform service disruption.

The vulnerability exists due to an integer overflow within apusys driver. A local privileged application can perform service disruption.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6853: All versions

MT6853T: All versions

MT6873: All versions

MT6875: All versions

MT6877: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6891: All versions

MT6893: All versions

MT9636: All versions

MT9638: All versions

MT9666: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU73099

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21761

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local privileged application to perform service disruption.

The vulnerability exists due to an integer overflow within apusys driver. A local privileged application can perform service disruption.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6853: All versions

MT6853T: All versions

MT6873: All versions

MT6875: All versions

MT6877: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6891: All versions

MT6893: All versions

MT9636: All versions

MT9638: All versions

MT9666: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Integer overflow

EUVDB-ID: #VU73098

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21760

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local privileged application to perform service disruption.

The vulnerability exists due to an integer overflow within apusys driver. A local privileged application can perform service disruption.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6853: All versions

MT6853T: All versions

MT6873: All versions

MT6875: All versions

MT6877: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6891: All versions

MT6893: All versions

MT9636: All versions

MT9638: All versions

MT9666: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU73097

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21759

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing bounds check within power service. A local privileged application can execute arbitrary code.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6580: All versions

MT6735: All versions

MT6739: All versions

MT6761: All versions

MT6765: All versions

MT6768: All versions

MT6769: All versions

MT6771: All versions

MT6779: All versions

MT6781: All versions

MT6785: All versions

MT6833: All versions

MT6853: All versions

MT6873: All versions

MT6875: All versions

MT6877: All versions

MT6879: All versions

MT6885: All versions

MT6891: All versions

MT6893: All versions

MT6895: All versions

MT6983: All versions

MT8167: All versions

MT8167S: All versions

MT8168: All versions

MT8173: All versions

MT8185: All versions

MT8321: All versions

MT8362A: All versions

MT8365: All versions

MT8385: All versions

MT8666: All versions

MT8675: All versions

MT8765: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8791: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Double Free

EUVDB-ID: #VU73096

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21758

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a double free within ccu. A local privileged application can execute arbitrary code.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6833: All versions

MT6853: All versions

MT6873: All versions

MT6877: All versions

MT6885: All versions

MT6893: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource exhaustion

EUVDB-ID: #VU73095

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21757

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a missing count check within WIFI Firmware. A local application can perform service disruption.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6833: All versions

MT6853: All versions

MT6877: All versions

MT6885: All versions

MT6889: All versions

MT6983: All versions

MT6985: All versions

MT8167S: All versions

MT8168: All versions

MT8175: All versions

MT8183: All versions

MT8185: All versions

MT8362A: All versions

MT8365: All versions

MT8385: All versions

MT8667: All versions

MT8675: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper Input Validation

EUVDB-ID: #VU73094

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21756

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local privileged application to gain access to sensitive information.

The vulnerability exists due to an incorrect bounds check within WLAN driver. A local privileged application can gain access to sensitive information.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6833: All versions

MT6853: All versions

MT6853T: All versions

MT6873: All versions

MT6875: All versions

MT6877: All versions

MT6879: All versions

MT6880: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6890: All versions

MT6891: All versions

MT6893: All versions

MT6895: All versions

MT6983: All versions

MT6985: All versions

MT8167S: All versions

MT8168: All versions

MT8175: All versions

MT8183: All versions

MT8185: All versions

MT8362A: All versions

MT8365: All versions

MT8385: All versions

MT8667: All versions

MT8675: All versions

MT8695: All versions

MT8696: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper Input Validation

EUVDB-ID: #VU73092

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21754

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing bounds check within WLAN driver. A local privileged application can execute arbitrary code.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6761: All versions

MT6762: All versions

MT6765: All versions

MT6768: All versions

MT6779: All versions

MT6781: All versions

MT6785: All versions

MT6833: All versions

MT6853: All versions

MT6873: All versions

MT6875: All versions

MT6877: All versions

MT6879: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6891: All versions

MT6893: All versions

MT6895: All versions

MT6983: All versions

MT8167S: All versions

MT8168: All versions

MT8175: All versions

MT8183: All versions

MT8185: All versions

MT8362A: All versions

MT8365: All versions

MT8385: All versions

MT8667: All versions

MT8675: All versions

MT8695: All versions

MT8696: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Use-after-free

EUVDB-ID: #VU64142

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-21745

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in WIFI firmware. A remote attacker can trick the victim into connecting to the malicious hotspot compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MT6761: All versions

MT6762: All versions

MT6765: All versions

MT6768: All versions

MT6769: All versions

MT6779: All versions

MT6781: All versions

MT6785: All versions

MT6789: All versions

MT6833: All versions

MT6853: All versions

MT6853T: All versions

MT6873: All versions

MT6875: All versions

MT6877: All versions

MT6879: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6891: All versions

MT6893: All versions

MT6895: All versions

MT6983: All versions

MT6985: All versions

MT8167S: All versions

MT8168: All versions

MT8175: All versions

MT8183: All versions

MT8185: All versions

MT8362A: All versions

MT8365: All versions

MT8385: All versions

MT8667: All versions

MT8675: All versions

MT8695: All versions

MT8696: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8791: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper Input Validation

EUVDB-ID: #VU73091

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21753

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing bounds check within WLAN driver. A local privileged application can execute arbitrary code.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6580: All versions

MT6735: All versions

MT6739: All versions

MT6761: All versions

MT6765: All versions

MT6768: All versions

MT6771: All versions

MT6779: All versions

MT6781: All versions

MT6785: All versions

MT6833: All versions

MT6853: All versions

MT6873: All versions

MT6877: All versions

MT6879: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6893: All versions

MT6895: All versions

MT6983: All versions

MT8167S: All versions

MT8168: All versions

MT8175: All versions

MT8183: All versions

MT8185: All versions

MT8362A: All versions

MT8365: All versions

MT8385: All versions

MT8667: All versions

MT8675: All versions

MT8695: All versions

MT8696: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper Input Validation

EUVDB-ID: #VU73090

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21752

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing bounds check within WLAN driver. A local privileged application can execute arbitrary code.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6580: All versions

MT6735: All versions

MT6739: All versions

MT6761: All versions

MT6765: All versions

MT6768: All versions

MT6771: All versions

MT6779: All versions

MT6781: All versions

MT6785: All versions

MT6833: All versions

MT6853: All versions

MT6873: All versions

MT6877: All versions

MT6879: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6893: All versions

MT6895: All versions

MT6983: All versions

MT8167S: All versions

MT8168: All versions

MT8175: All versions

MT8183: All versions

MT8185: All versions

MT8362A: All versions

MT8365: All versions

MT8385: All versions

MT8667: All versions

MT8675: All versions

MT8695: All versions

MT8696: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper Input Validation

EUVDB-ID: #VU73089

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21751

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing bounds check within WLAN driver. A local privileged application can execute arbitrary code.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6771: All versions

MT8167S: All versions

MT8168: All versions

MT8175: All versions

MT8183: All versions

MT8185: All versions

MT8362A: All versions

MT8365: All versions

MT8385: All versions

MT8667: All versions

MT8675: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improper Input Validation

EUVDB-ID: #VU73088

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21750

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing bounds check within WLAN driver. A local privileged application can execute arbitrary code.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6761: All versions

MT6779: All versions

MT6781: All versions

MT6833: All versions

MT6853: All versions

MT6873: All versions

MT6877: All versions

MT6879: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6893: All versions

MT6895: All versions

MT6983: All versions

MT8167S: All versions

MT8168: All versions

MT8175: All versions

MT8183: All versions

MT8185: All versions

MT8362A: All versions

MT8365: All versions

MT8385: All versions

MT8667: All versions

MT8675: All versions

MT8696: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Improper Access Control

EUVDB-ID: #VU73087

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21749

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within telephony. A local application can gain access to sensitive information.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6739: All versions

MT6750: All versions

MT6750S: All versions

MT6752: All versions

MT6753: All versions

MT6755: All versions

MT6755S: All versions

MT6757: All versions

MT6757C: All versions

MT6757CD: All versions

MT6757CH: All versions

MT6758: All versions

MT6761: All versions

MT6762: All versions

MT6763: All versions

MT6765: All versions

MT6768: All versions

MT6769: All versions

MT6771: All versions

MT6779: All versions

MT6781: All versions

MT6785: All versions

MT6789: All versions

MT6795: All versions

MT6797: All versions

MT6799: All versions

MT6833: All versions

MT6853: All versions

MT6853T: All versions

MT6873: All versions

MT6875: All versions

MT6877: All versions

MT6879: All versions

MT6880: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6890: All versions

MT6891: All versions

MT6893: All versions

MT6895: All versions

MT6983: All versions

MT6985: All versions

MT8321: All versions

MT8666: All versions

MT8675: All versions

MT8765: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8791: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper Access Control

EUVDB-ID: #VU73086

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21748

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to a missing permission check within telephony. A local application can gain access to sensitive information.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6580: All versions

MT6735: All versions

MT6737: All versions

MT6739: All versions

MT6753: All versions

MT6761: All versions

MT6765: All versions

MT6768: All versions

MT6771: All versions

MT6779: All versions

MT6781: All versions

MT6785: All versions

MT6833: All versions

MT6853: All versions

MT6873: All versions

MT6877: All versions

MT6879: All versions

MT6883: All versions

MT6885: All versions

MT6889: All versions

MT6893: All versions

MT6895: All versions

MT6983: All versions

MT8321: All versions

MT8666: All versions

MT8675: All versions

MT8765: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8791: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Improper Input Validation

EUVDB-ID: #VU73085

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21747

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local privileged application to perform service disruption.

The vulnerability exists due to a missing bounds check within imgsensor. A local privileged application can perform service disruption.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6771: All versions

MT6779: All versions

MT6781: All versions

MT6785: All versions

MT6833: All versions

MT6853: All versions

MT6873: All versions

MT6885: All versions

MT6893: All versions

MT8167: All versions

MT8167S: All versions

MT8168: All versions

MT8173: All versions

MT8362A: All versions

MT8365: All versions

MT8765: All versions

MT8766: All versions

MT8768: All versions

MT8786: All versions

MT8788: All versions

MT8789: All versions

MT8797: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Improper Input Validation

EUVDB-ID: #VU73084

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21746

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local privileged application to perform service disruption.

The vulnerability exists due to a missing bounds check within imgsensor. A local privileged application can perform service disruption.

Mitigation

Install security update from vendor's website.

Vulnerable software versions

MT6771: All versions

MT6779: All versions

MT6781: All versions

MT6785: All versions

MT6833: All versions

MT6853: All versions

MT6873: All versions

MT6885: All versions

MT6893: All versions

MT8167: All versions

MT8167S: All versions

MT8168: All versions

MT8175: All versions

MT8362A: All versions

MT8365: All versions

MT8788: All versions

CPE2.3 External links

https://corp.mediatek.com/product-security-bulletin/June-2022


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###