MediaTek wlan AP driver out-of-bounds write enables adjacent privilege escalation

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422399; Issue ID: MSV-3748.

MediaTek identifies the following affected chipsets:

• MT6890
• MT7916
• MT7981
• MT7986

The structured affected data identifies these branches for MT6890:

• SDK release 7.6.7.2 and before.
• OpenWrt 19.07 and 21.02.

No exact fixed release is provided in the record or in the inspected bulletin. The status of other OEM firmware, SDK, or OpenWrt branches remains unverified; branches not listed should not be assumed safe. MediaTek also warns that the affected-chipset list may be incomplete.

The MediaTek wlan AP driver performs an incorrect bounds check on data processed by the access-point path, creating a possible out-of-bounds write. The supplied record classifies the weakness as CWE-787, while MediaTek's bulletin identifies CWE-1287, so the public classifications are not fully aligned. According to the record, an attacker reachable from a proximal or adjacent network can trigger the vulnerable path without user interaction and without pre-existing privileges. The write could corrupt memory and enable privilege escalation, but the available evidence does not disclose the specific input field, buffer, code path, or memory layout, so the precise exploit chain remains unknown. MediaTek identifies MT6890, MT7916, MT7981, and MT7986 as affected chipsets.

• Reachability: The issue is described as remotely exploitable from a proximal or adjacent network, rather than requiring direct local access to the device.
• Privileges and interaction: The supplied assessment states that no pre-existing privileges and no user interaction are required.
• Complexity: The supplied assessment describes the exploitation conditions as low complexity.
• Known status: The record marks public exploit as false. MediaTek stated that, at the time of its bulletin, it was not aware of active exploitation of these vulnerabilities in the wild. No specific campaign, victim, or breach is identified.

The flaw creates a possible out-of-bounds write in the wlan AP driver and may result in privilege escalation within the same security scope. If exploited, potential outcomes include modification of protected state, exposure of data accessible to the higher-privileged process, or WLAN service disruption. The available evidence does not establish arbitrary code execution, a particular level of device control, or an actual breach. The practical outcome depends on the OEM firmware, deployment configuration, and whether the vulnerable path can be reached from an adjacent network.

• Successful exploitation could let an attacker perform actions with higher privileges on the affected device or WLAN component.
• The out-of-bounds write could corrupt memory, causing instability or disruption of access-point service.
• The supplied assessment indicates potential confidentiality, integrity, and availability impact within the same security scope, but it does not establish a specific breach, code-execution scenario, or data-loss event.
• Organizations operating affected chipsets should coordinate with their OEMs to identify firmware containing the fix, because MediaTek notes that its affected-chipset list may be incomplete.

1. Identify devices using the affected chipsets and obtain OEM firmware or a driver update incorporating Patch ID WCNCR00422399. The available evidence does not identify a specific public fixed release.
2. Prioritize MT6890 deployments running SDK release 7.6.7.2 and before or OpenWrt 19.07 and 21.02, following the supplied affected boundaries.
3. If an update is not yet available, coordinate with the OEM or MediaTek to confirm the correction associated with Issue ID MSV-3748. Do not assume that an unlisted newer or parallel branch is fixed without confirmation.
4. As a temporary risk-reduction measure, restrict reachability from untrusted adjacent WLAN sources where operationally feasible. This is an inferred exposure-reduction measure, not a confirmed workaround, and does not replace the patch.

1. Inventory devices using MT6890, MT7916, MT7981, or MT7986, then identify the OEM firmware and wlan AP driver deployed on each device.
2. Compare deployments with the affected branches listed in affected_summary and confirm whether the firmware or driver includes Patch ID WCNCR00422399.
3. Review telemetry for anomalies following adjacent WLAN traffic, including unexpected privilege changes, access-point crashes, access-point restarts, or loss of WLAN integrity and availability. These are precautionary monitoring signals, not vendor-confirmed indicators.
4. Preserve firmware images, chipset information, and relevant logs for OEM investigation. No specific IOC or log event is provided; the absence of such evidence does not prove that a system is safe.