CVE-2025-20674: MediaTek Software Development Kit

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413202; Issue ID: MSV-3303.

Affected products

• MediaTek Software Development Kit: up to and including 7.6.7.2
• Openwrt Openwrt: version 19.07.0 only; version 21.02.0 only; version 23.05 only

Published 2025-06-02. Last modified 2026-06-17.