CVE-2019-15027: MediaTek MT6577 Firmware

Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days.

The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows attackers to execute arbitrary commands as root via shell metacharacters in a filename under /data, because clear_emmc_nomedia_entry in platform/mt6577/external/meta/emmc/meta_clr_emmc.c invokes 'system("/system/bin/rm -r /data/' followed by this filename upon an eMMC clearance from a Meta Mode boot. NOTE: compromise of Fire OS on the Amazon Echo Dot would require a second hypothetical vulnerability that allows creation of the required file under /data.

Affected products

• MediaTek MT6577 Firmware: affected versions not specified
• MediaTek MT6625 Firmware: affected versions not specified
• MediaTek MT8163 Firmware: affected versions not specified

Published 2019-08-14. Last modified 2026-06-17.