Improper Validation of Array Index in MediaTek products - CVE-2023-20633
Published: March 6, 2023
Vulnerability identifier: #VU72791
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-20633
CWE-ID: CWE-129
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to a missing bounds check within usb. A local privileged application can execute arbitrary code.
Affected software
MT6833
MT8675
MT8666
MT8168
MT8167
MT6983
MT6895
MT6855
MT6580
MT6789
MT6771
MT6768
MT6765
MT6763
MT6761
MT6739
MT6735
MT6893
MT6885
MT6873
MT6853
MT6785
MT6781
MT6779
MT8675
MT8666
MT8168
MT8167
MT6983
MT6895
MT6855
MT6580
MT6789
MT6771
MT6768
MT6765
MT6763
MT6761
MT6739
MT6735
MT6893
MT6885
MT6873
MT6853
MT6785
MT6781
MT6779
How to mitigate CVE-2023-20633
Install security update from vendor's website.