#VU103574 Reachable Assertion in MediaTek products - CVE-2024-20147

Published: 2025-02-04

Vulnerability identifier: #VU103574

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-20147

CWE-ID: CWE-617

Exploitation vector: Local

Exploit availability: No

Vendor: MediaTek

Description

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to improper exception handling within Bluetooth. A local application can perform service disruption.

Mitigation
Install security update from vendor's website.

Vulnerable software versions

MT2737: All versions

MT3603: All versions

MT6835: All versions

MT6878: All versions

MT6886: All versions

MT6897: All versions

MT6985: All versions

MT6989: All versions

MT6990: All versions

MT7902: All versions

MT7920: All versions

MT7921: All versions

MT7922: All versions

MT7925: All versions

MT7927: All versions

MT8195: All versions

MT8370: All versions

MT8390: All versions

MT8395: All versions

MT8518S: All versions

MT8532: All versions

MT8678: All versions

External links
https://corp.mediatek.com/product-security-bulletin/February-2025

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.