MediaTek Warns of Multiple Vulnerabilities that let Attackers Escalate Privileges

The UAE Cyber Security Council recommends immediate network segmentation for critical infrastructure using affected chipsets and continuous monitoring for anomalous base station associations. The March 2025 Product Security Bulletin highlights three high severity vulnerabilities CVE-2025-20644, CVE-2025-20645, and CVE-2025-20646—affecting modem firmware, cryptographic key management, and Wi-Fi subsystems. Attackers within proximity can achieve remote privilege escalation without user interaction, compromising devices through unpatched Wi-Fi drivers in chips like the MT7663 (common in smart home hubs) and MT7986 (used in enterprise routers). As attackers increasingly target hardware supply chains, MediaTek’s response sets a critical precedent for silicon vendors balancing rapid innovation with robust security hygiene. These vulnerabilities impact over 37% of global smartphones and IoT devices using MediaTek’s MT67xx, MT68xx, and MT69xx series chipsets. These vulnerabilities compound existing risks from earlier disclosures, such as CVE-2024-20154, a critical modem flaw patched in January 2025 that allowed RCE via rogue cellular tower. Enterprises leveraging MediaTek’s Genio 1200 AIoT platforms should audit SDK versions, as vulnerabilities in 7.6.7.0 and earlier SDKs remain unpatched in legacy deployments. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Additionally, CVE-2025-20630 enables adjacent-network RCE in MediaTek’s MT7603 and MT7622 Wi-Fi SoCs, posing risks to industrial IoT deployments. Unpatched IoT devices, particularly those in smart cities and industrial control systems, face heightened risks of botnet recruitment or data exfiltration. According tot the Report, With MediaTek powering 1.5 billion devices annually, these vulnerabilities threaten sectors from consumer electronics to healthcare. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. This vulnerability affects devices running Android 14 and 15, including MediaTek’s automotive-grade MT2712 SoCs. Affected chipsets include the MT6833P (Dimensity 700 series) and MT6895TT (Dimensity 9000 series), widely used in mid-range 5G smartphones.

This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 03 Mar 2025 11:05:18 +0000

Cyber News related to MediaTek Warns of Multiple Vulnerabilities that let Attackers Escalate Privileges

MediaTek Warns of Multiple Vulnerabilities that let Attackers Escalate Privileges - The UAE Cyber Security Council recommends immediate network segmentation for critical infrastructure using affected chipsets and continuous monitoring for anomalous base station associations. The March 2025 Product Security Bulletin highlights three ...
1 month ago Cybersecuritynews.com CVE-2025-20644

New 5Ghoul Attack Impacts 5G Devices From Popular Brands - Cybersecurity researchers from the following organizations recently discovered the new 5Ghoul attack that impacts the 5G devices from popular brands:-. 5Ghoul exposes 5G vulnerabilities in Qualcomm and MediaTek modems, impacting smartphones, routers, ...
1 year ago Cybersecuritynews.com

5Ghoul Revisited: Three Months Later - About three months ago, I wrote about the implications and impacts of 5Ghoul in a previous diary. The 5Ghoul family of vulnerabilities could cause User Equipment to be continuously exploited once they are connected to the malicious 5Ghoul gNodeB. ...
1 year ago Isc.sans.edu CVE-2023-32844 CVE-2023-32846 CVE-2023-32845 CVE-2023-32841

CISA adds Check Point Quantum Security Gateways and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog - CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog. CISA adds ...
10 months ago Securityaffairs.com

CERT-UA warns of malware campaign conducted by threat actor UAC-0006 - Threat actors may have exploited a zero-day in older iPhones, Apple warns. Microsoft fixed two zero-day bugs exploited in malware attacks. Threat actors actively exploit JetBrains TeamCity flaws to deliver malware. Recent DarkGate campaign exploited ...
10 months ago Securityaffairs.com CVE-2023-49103 CVE-2023-46747 CVE-2023-46748 CVE-2023-4966 CVE-2023-3519

Cisco says critical Unity Connection bug lets attackers get root - Cisco has patched a critical Unity Connection security flaw that can let unauthenticated attackers remotely gain root privileges on unpatched devices. Unity Connection is a fully virtualized messaging and voicemail solution for email inboxes, web ...
1 year ago Bleepingcomputer.com CVE-2024-20287

Dual Privilege Escalation Chain: Exploiting Monitoring and Service Mesh Configurations and Privileges in GKE to Gain Unauthorized Access in Kubernetes - While each issue might not result in significant damage on its own, when combined they create an opportunity for an attacker who already has access to a Kubernetes cluster to escalate their privileges. If an attacker has the ability to execute in the ...
1 year ago Unit42.paloaltonetworks.com

CISA: Critical Ivanti auth bypass bug now actively exploited - CISA warns that a critical authentication bypass vulnerability in Ivanti's Endpoint Manager Mobile and MobileIron Core device management software is now under active exploitation. Tracked as CVE-2023-35082, the flaw is a remote unauthenticated API ...
1 year ago Bleepingcomputer.com CVE-2023-35082

Strobes 2023 Pentesting Recap: Trends, Stats, and How PTaaS is Transforming Cybersecurity - This article covers some amazing statistics on what category of vulnerabilities we commonly report across 100s of customers, and how we reduce compliance times and turn around time to reporting critical vulnerabilities. In a different article, we ...
1 year ago Securityboulevard.com

Zyxel warns of multiple critical vulnerabilities in NAS devices - Zyxel has addressed multiple security issues, including three critical ones that could allow an unauthenticated attacker to execute operating system commands on vulnerable network-attached storage devices. Zyxel NAS systems are used for storing data ...
1 year ago Bleepingcomputer.com CVE-2023-35137 CVE-2023-35138

Cyber Security News Letter: Key Updates on Attacks, Vulnerabilities, & Data Breaches - Attackers are actively exploiting critical vulnerabilities in on-premises Microsoft Exchange and SharePoint servers, using advanced NTLM relay and credential theft techniques for persistent access. Researchers have detected a new JScript loader ...
2 days ago Cybersecuritynews.com CVE-2025-24054

Why CVEs Are an Incentives Problem - I've been thinking about some of these unintended consequences in the context of a growing problem faced by all of us in cybersecurity: how a fast-rising tide of software vulnerabilities tracked as common vulnerabilities and exposures - are reported ...
10 months ago Darkreading.com

FBI warns of gift card fraud ring targeting retail companies - The FBI warned retail companies in the United States that a financially motivated hacking group has been targeting employees in their gift card departments in phishing attacks since at least January 2024. Tracked as Storm-0539, this hacking group ...
11 months ago Bleepingcomputer.com

Creating a formula for effective vulnerability prioritization - In this Help Net Security interview, Michael Gorelik, CTO and Head of Malware Research at Morphisec, provides insights into the business impact of vulnerabilities. Gorelik discusses challenges posed by regulatory frameworks, incomplete asset ...
1 year ago Helpnetsecurity.com

US offering $15m for info on ALPHV/Blackcat ransomware crew The Register - Infosec in brief The US government is offering bounties up to $15 million as a reward for anyone willing to help it take out the APLHV/Blackcat ransomware gang. ALPHV has made a habit of going after critical infrastructure targets, and last week ...
1 year ago Go.theregister.com CVE-2024-23816 CVE-2023-51440 CVE-2024-22042

MediaTek Security Update - Patch for Vulnerabilities Affecting Smartphone, Tablet, & other Devices - The bulletin, published today, highlights significant security risks affecting a wide array of devices, including smartphones, tablets, IoT devices, smart displays, and various multimedia equipment. This security update exemplifies MediaTek’s ...
2 weeks ago Cybersecuritynews.com CVE-2025-20654

Don't get hacked! Apply the right vulnerability metrics to Kubernetes scans - As you read this, I'd like you to keep in mind that CVSS was never intended to be that end-all software vulnerability scoring system. Doesn't reflect actual risk - CVSS provides a base score that represents the inherent severity of a vulnerability in ...
1 year ago Securityboulevard.com

Misconfiguration and vulnerabilities biggest risks in cloud security: Report - The two biggest cloud security risks continue to be misconfigurations and vulnerabilities, which are being introduced in greater numbers through software supply chains, according to a report by Sysdig. While zero trust is a top priority, data showed ...
2 years ago Csoonline.com Hunters

Cyber Insights 2023: The Geopolitical Effect - The result is more than a dozen features on subjects ranging from AI, quantum encryption, and attack surface management to venture capital, regulations, and criminal gangs. The Russia/Ukraine war that started in early 2022 has been mirrored by a ...
2 years ago Securityweek.com

CISA warns agencies of fourth flaw used in Triangulation spyware attacks - The U.S. Cybersecurity and Infrastructure Security Agency has added to its to the Known Exploited Vulnerabilities catalog six vulnerabilities that impact products from Apple, Adobe, Apache, D-Link, and Joomla. The Known Exploited Vulnerabilities ...
1 year ago Bleepingcomputer.com CVE-2023-27524 CVE-2023-41990 CVE-2023-38203 CVE-2023-29300 CVE-2016-20017

Over 100 WordPress Repository Plugins Affected by Shortcode-based Stored Cross-Site Scripting - On August 14, 2023, the Wordfence Threat Intelligence team began a research project to find Stored Cross-Site Scripting via Shortcode vulnerabilities in WordPress repository plugins. We found over 100 vulnerabilities across 100 plugins which affect ...
1 year ago Wordfence.com

ShadowRay Vulnerability: 6 Lessons for AI & Cybersecurity - This exposure is under active attack, yet Ray disputes that the exposure is a vulnerability and doesn't intend to fix it. The dispute between Ray's developers and security researchers highlights hidden assumptions and teaches lessons for AI security, ...
1 year ago Esecurityplanet.com CVE-2023-48022

ChatGPT side-channel attack has easy fix: token obfuscation The Register - In brief Almost as quickly as a paper came out last week revealing an AI side-channel vulnerability, Cloudflare researchers have figured out how to solve it: just obscure your token size. The paper [PDF], from researchers at the Offensive AI ...
1 year ago Go.theregister.com

Microsoft Patch Tuesday 2024: 49 Vulnerabilities are fixed - Microsoft released its first patch on Tuesday, 2024, in which nearly 49 vulnerabilities have been fixed in Microsoft products and 5 vulnerabilities in non-Microsoft products. Among these 49 vulnerabilities, there were 12 remote code execution ...
1 year ago Cybersecuritynews.com CVE-2024-20674 CVE-2024-20700 CVE-2024-0057

Out-of-bounds reads in Adobe Acrobat; Foxit PDF Reader contains vulnerability that could lead to SYSTEM-level privileges - Cisco Talos' Vulnerability Research team has helped to disclose and patch more than 20 vulnerabilities over the past three weeks, including two in the popular Adobe Acrobat Reader software. Acrobat, one of the most popular PDF readers currently ...
10 months ago Blog.talosintelligence.com