CVE-2025-20637

In network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00399035; Issue ID: MSV-2380.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://corp.mediatek.com/product-security-bulletin/February-2025	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:mediatek:mt7981:-:::::::*
	cpe:2.3:h:mediatek:mt7986:-:::::::*

History

18 Feb 2025, 19:15

Type	Values Removed	Values Added
Summary		(es) En el hardware de red, existe un posible bloqueo de sistema debido a una excepción no detectada. Esto podría provocar una denegación de servicio remota sin necesidad de privilegios de ejecución adicionales. No se necesita interacción del usuario para la explotación. ID de parche: WCNCR00399035; ID de problema: MSV-2380.

03 Feb 2025, 17:54

Type	Values Removed	Values Added
First Time		Mediatek mt7981 Mediatek software Development Kit Mediatek mt7986 Mediatek
References	~~() https://corp.mediatek.com/product-security-bulletin/February-2025 -~~	() https://corp.mediatek.com/product-security-bulletin/February-2025 - Vendor Advisory
CPE		cpe:2.3:h:mediatek:mt7986:-:::::::* cpe:2.3:a:mediatek:software_development_kit:::::::: cpe:2.3:h:mediatek:mt7981:-:::::::*

03 Feb 2025, 17:15

Type	Values Removed	Values Added
CWE		CWE-754
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

03 Feb 2025, 04:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-03 04:15

Updated : 2025-03-17 15:15

NVD link : CVE-2025-20637

Mitre link : CVE-2025-20637

CVE.ORG link : CVE-2025-20637

JSON object : View

Products Affected

mediatek

software_development_kit
mt7981
mt7986

CWE

CWE-248

Uncaught Exception

CWE-754

Improper Check for Unusual or Exceptional Conditions

{"id": "CVE-2025-20637", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-02-03T04:15:08.747", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/February-2025", "tags": ["Vendor Advisory"], "source": "security@mediatek.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@mediatek.com", "description": [{"lang": "en", "value": "CWE-248"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "In network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00399035; Issue ID: MSV-2380."}, {"lang": "es", "value": "En el hardware de red, existe un posible bloqueo de sistema debido a una excepci\u00f3n no detectada. Esto podr\u00eda provocar una denegaci\u00f3n de servicio remota sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n. ID de parche: WCNCR00399035; ID de problema: MSV-2380."}], "lastModified": "2025-03-17T15:15:43.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "521ABF30-6B3D-466F-83D4-E2C4297E27C7", "versionEndIncluding": "7.6.7.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "490CD97B-021F-4350-AEE7-A2FA866D5889"}, {"criteria": "cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "40A9E917-4B34-403F-B512-09EEBEA46811"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@mediatek.com"}