#VU70678 Input validation error in MediaTek products - CVE-2022-32664

Vulnerability identifier: #VU70678

Vulnerability risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-32664

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
EN7516
Mobile applications / Mobile firmware & hardware
EN7528
Mobile applications / Mobile firmware & hardware
EN7529
Mobile applications / Mobile firmware & hardware
EN7561
Mobile applications / Mobile firmware & hardware
EN7562
Mobile applications / Mobile firmware & hardware
EN7580
Mobile applications / Mobile firmware & hardware

Vendor: MediaTek

Description

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input within Config Manager component. A local application can trick the victim into opening a specially crafted input and escalate privileges on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

EN7516: All versions

EN7528: All versions

EN7529: All versions

EN7561: All versions

EN7562: All versions

EN7580: All versions

---

External links
http://corp.mediatek.com/product-security-bulletin/January-2023

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.