Main Vulnerability Database Vulnerabilities #VU86972

Improper input validation in MediaTek products - CVE-2024-20028

Published: March 4, 2024

Vulnerability identifier: #VU86972

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-20028

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to lack of valudation within da. A local privileged application can execute arbitrary code.

MT6833
MT8512
MT8168
MT8167
MT8163
MT6739
MT6771
MT6768
MT6765
MT6763
MT6761
MT6757
MT6893
MT6885
MT6877
MT6873
MT6853
MT6785
MT6779
Google Android

Install security update from vendor's website.

Google Android - addressed in versions 11 2024-03-05, 12L 2024-03-05, 12 2024-03-05, 13 2024-03-05, 14 2024-03-05