CVE-2023-20820

In wlan service, there is a possible command injection due to improper input validation. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00244189; Issue ID: WCNCR00244189.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://corp.mediatek.com/product-security-bulletin/September-2023	Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/September-2023	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:openwrt:openwrt:19.07.0:-::::::
	cpe:2.3:o:openwrt:openwrt:21.02.0:-::::::

OR	cpe:2.3:h:mediatek:mt6890:-:::::::*
	cpe:2.3:h:mediatek:mt7603:-:::::::*
	cpe:2.3:h:mediatek:mt7612:-:::::::*
	cpe:2.3:h:mediatek:mt7613:-:::::::*
	cpe:2.3:h:mediatek:mt7615:-:::::::*
	cpe:2.3:h:mediatek:mt7622:-:::::::*
	cpe:2.3:h:mediatek:mt7626:-:::::::*
	cpe:2.3:h:mediatek:mt7629:-:::::::*
	cpe:2.3:h:mediatek:mt7915:-:::::::*
	cpe:2.3:h:mediatek:mt7916:-:::::::*
	cpe:2.3:h:mediatek:mt7981:-:::::::*
	cpe:2.3:h:mediatek:mt7986:-:::::::*
	cpe:2.3:h:mediatek:mt7990:-:::::::*

History

21 Nov 2024, 07:41

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-04 03:15

Updated : 2024-11-21 07:41

NVD link : CVE-2023-20820

Mitre link : CVE-2023-20820

CVE.ORG link : CVE-2023-20820

JSON object : View

Products Affected

mediatek

mt6890
mt7622
mt7612
mt7613
mt7981
mt7626
mt7916
mt7986
mt7603
mt7915
mt7615
mt7629
mt7990

openwrt

openwrt

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-20820", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2023-09-04T03:15:07.840", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/September-2023", "tags": ["Vendor Advisory"], "source": "security@mediatek.com"}, {"url": "https://corp.mediatek.com/product-security-bulletin/September-2023", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In wlan service, there is a possible command injection due to improper input validation. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00244189; Issue ID: WCNCR00244189."}, {"lang": "es", "value": "En wlan service, se presenta una posible inyecci\u00f3n de comando debido a una comprobaci\u00f3n de entrada inapropiada. Esto podr\u00eda conducir a la divulgaci\u00f3n de informaci\u00f3n local con privilegios de ejecuci\u00f3n del sistema necesarios. No es necesaria la interacci\u00f3n del usuario para su explotaci\u00f3n. ID del parche: WCNCR00244189; ID de la incidencia: WCNCR00244189."}], "lastModified": "2024-11-21T07:41:36.537", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FA469E2-9E63-4C9A-8EBA-10C8C870063A"}, {"criteria": "cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0133207-2EED-4625-854F-8DB7770D5BF7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72"}, {"criteria": "cpe:2.3:h:mediatek:mt7603:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8A45CDA9-95E6-4C02-8C3C-3B0CF7272A6F"}, {"criteria": "cpe:2.3:h:mediatek:mt7612:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EF2E9975-607D-4F06-A85A-B1C2BE3C5B75"}, {"criteria": "cpe:2.3:h:mediatek:mt7613:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4979BA07-DC09-4DF8-BA7F-E4143A0ECFE6"}, {"criteria": "cpe:2.3:h:mediatek:mt7615:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "05748BB1-0D48-4097-932E-E8E2E574FD8D"}, {"criteria": "cpe:2.3:h:mediatek:mt7622:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "55EB4B27-6264-45BE-9A22-BE8418BB0C06"}, {"criteria": "cpe:2.3:h:mediatek:mt7626:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "79C6A4C1-BAB5-4C53-91CF-2637C2ECF37F"}, {"criteria": "cpe:2.3:h:mediatek:mt7629:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "29C210A3-C71E-4010-9DD6-9E36CADC9EED"}, {"criteria": "cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3AB22996-9C22-4B6C-9E94-E4C055D16335"}, {"criteria": "cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DD5AA441-5381-4179-89EB-1642120F72B4"}, {"criteria": "cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "490CD97B-021F-4350-AEE7-A2FA866D5889"}, {"criteria": "cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "40A9E917-4B34-403F-B512-09EEBEA46811"}, {"criteria": "cpe:2.3:h:mediatek:mt7990:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4901B2A5-B0C8-4A0C-AC17-87D469744817"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@mediatek.com"}