MediaTek Chipsets Zero-Click Vulnerability Detected by Researchers, Can Affect Routers and Smartphones

The critical zero-click vulnerability in MediaTek chipsets has been designated the label CVE-2024-20017.

Written by Akash Dutta, Edited by Siddharth Suvarna | Updated: 23 September 2024 16:41 IST

MediaTek Chipsets Zero-Click Vulnerability Detected by Researchers, Can Affect Routers and Smartphones

Photo Credit: MediaTek

MediaTek has released a firmware update patching the vulnerability

Highlights

The vulnerability was discovered by SonicWall Capture Labs
The reported vulnerability might exist in some Xiaomi smartphones
The vulnerability in the MediaTek chip allows for RCE hacks

MediaTek chipsets are reportedly carrying a critical vulnerability which might make it easy for hackers to exploit remote code execution (RCE) attacks. According to a cybersecurity firm, some of the chips have this vulnerability which majorly impacts devices such as routers and smartphones. Notably, the vulnerability was reported in March, however, a proof-of-concept was published recently on GitHub highlighting that exploiting this was possible. The firm has rated it a critical zero-click vulnerability with a CVSS 3.0 score of 9.8.

MediaTek Chipsets Said to Be Carrying Major Vulnerability

In a blog post, the threat research team of SonicWall Capture Labs has detailed the new vulnerability. The flaw has been designated CVE-2024-20017 and is described as a critical zero-click vulnerability. Put simply, this type of security flaw allows attackers to exploit a system remotely, without any action or interaction required from the victim. This means the user does not need to follow any templates used in a traditional phishing attack.

The researchers gave the vulnerability a score of 9.8, highlighting its critical nature. The issue was spotted particularly in two MediaTek Wi-Fi chipsets, MT7622 and MT7915, as well as the RTxxxx series SoftAP driver bundles. These chipsets are typically used by manufacturers such as Xiaomi, Ubiquiti, and Netgear for smartphones and routers. As per the cybersecurity firm, the vulnerability affects MediaTek SDK versions 7.4.0.1 and earlier and OpenWrt versions 19.07 and 21.02.

[Sponsored] Samsung Galaxy S24: The Ultimate Camera Phone With Smarter On-Device AI

Coming to the exploitation, this vulnerability opens the possibility for a remote code execution. As per the researchers, attackers can use a “table overwrite technique via a return-oriented programming (ROP) chain” to gather sensitive information from the device without the need for the user to do anything.

One reason why the vulnerability is being highlighted now instead of March when it was first discovered, is because a GitHub post has showcased a proof-of-concept of the vulnerability, explaining that carrying out an attack using CVE-2024-20017 is possible.

Notably, the researchers reached out to MediaTek and the chip maker has released patches to fix the security flaw. Users have also been requested to update the firmware as soon as possible.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Further reading: MediaTek, Cybersecurity, Smartphones, Xiaomi

Akash Dutta Email Akash Dutta

Akash Dutta is a Senior Sub Editor at Gadgets 360. He is particularly interested in the social impact of technological developments and loves reading about emerging fields such as AI, metaverse, and fediverse. In his free time, he can be seen supporting his favourite football club - Chelsea, watching movies and anime, and sharing passionate opinions on food. More