Improper Handling of Insufficient Permissions or Privileges in MediaTek products - CVE-2026-20448
Published: May 4, 2026
Vulnerability identifier: #VU129560
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-20448
CWE-ID: CWE-280
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to improper handling of insufficient permissions or privileges in geniezone when performing privileged operations. A local user can invoke the vulnerable functionality to escalate privileges.
Affected software
MT8768
MT8910
MT8893
MT8796
MT8793
MT8792
MT8791T
MT8788E
MT8786
MT8781
MT8775
MT6765
MT8766
MT8367
MT6993
MT6991
MT6989
MT6899
MT6897
MT6789
MT6768
MT6877
MT8910
MT8893
MT8796
MT8793
MT8792
MT8791T
MT8788E
MT8786
MT8781
MT8775
MT6765
MT8766
MT8367
MT6993
MT6991
MT6989
MT6899
MT6897
MT6789
MT6768
MT6877
How to mitigate CVE-2026-20448
Install security update from vendor's website.