Out-of-bounds write in MediaTek products - CVE-2025-20632

Vulnerability identifier: #VU103560

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-20632

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to an incorrect bounds check within wlan. A local application can execute arbitrary code.

MT7615
MT7622
MT7663
MT7915
MT7916
MT7981
MT7986
VigorAP 903
Vigor2620 LTE
VigorLTE 200n
Vigor2915
Vigor2135
Vigor2765
Vigor2766
Vigor2866 LTE
Vigor2927L-5G
Vigor2927 LTE
Vigor2927
Vigor2866
Vigor2865L-5G
Vigor2865 LTE
Vigor2865
VigorAP 805
VigorAP 962C
VigorAP 1062C
Vigor C410
Vigor C510
Vigor2136

Install security update from vendor's website.

VigorAP 903 - update to 1.4.18
Vigor2620 LTE - update to 3.9.9.3
VigorLTE 200n - update to 3.9.9.3
Vigor2915 - update to 4.4.5.1
Vigor2135 - update to 4.4.5.7
Vigor2765 - update to 4.4.5.7
Vigor2766 - update to 4.4.5.7
Vigor2866 LTE - update to 4.4.6.1
Vigor2927L-5G - update to 4.4.6.1
Vigor2927 LTE - update to 4.4.6.1
Vigor2927 - update to 4.4.6.1
Vigor2866 - update to 4.4.6.1
Vigor2865L-5G - update to 4.4.6.1
Vigor2865 LTE - update to 4.4.6.1
Vigor2865 - update to 4.4.6.1
VigorAP 805 - update to 5.0.4
VigorAP 962C - update to 5.0.4
VigorAP 1062C - update to 5.0.4
Vigor C410 - update to 5.3.1
Vigor C510 - update to 5.3.1
Vigor2136 - update to 5.3.1

• https://corp.mediatek.com/product-security-bulletin/February-2025

• Multiple vulnerabilities in MediaTek chipsets
• Multiple WLAN driver vulnerabilities in DrayTek routers