Vulnerability Name:

CVE-2022-26447 (CCN-235342)

Assigned:2022-09-05
Published:2022-09-05
Updated:2022-09-09
Summary:In BT firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784478; Issue ID: ALPS06784478.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-20
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2022-26447

Source: CCN
Type: MediaTek Web site
September 2022 Product Security Bulletin

Source: MISC
Type: Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/September-2022

Source: XF
Type: UNKNOWN
mediatek-cve202226447-code-exec(235342)

Vulnerable Configuration:Configuration 1:
  • cpe:/o:google:android:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:11.0:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:12.0:*:*:*:*:*:*:*
  • OR cpe:/o:yoctoproject:yocto:3.1:*:*:*:*:*:*:*
  • AND
  • cpe:/h:mediatek:mt6757:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6771:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6739:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6763:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6580:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6735:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6737:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6750s:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6753:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6755s:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6757c:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6757cd:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6757ch:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8163:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8167:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8167s:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8173:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8183:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8321:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8362a:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8385:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8518:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8532:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8765:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8788:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/h:mediatek:mt6580:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8167:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8183:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8362a:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8385:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6735:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6737:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6739:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6750s:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6753:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6755s:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6757:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6757c:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6757cd:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6757ch:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6763:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt6771:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8163:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8167s:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8173:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8321:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8532:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8765:-:*:*:*:*:*:*:*
  • OR cpe:/h:mediatek:mt8788:-:*:*:*:*:*:*:*
  • AND
  • cpe:/o:google:android:10:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:11:*:*:*:*:*:*:*
  • OR cpe:/o:google:android:12:*:*:*:*:*:*:*
  • OR cpe:/o:yoctoproject:yocto:3.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    google android 10.0
    google android 11.0
    google android 12.0
    yoctoproject yocto 3.1
    mediatek mt6757 -
    mediatek mt6771 -
    mediatek mt6739 -
    mediatek mt6763 -
    mediatek mt6580 -
    mediatek mt6735 -
    mediatek mt6737 -
    mediatek mt6750s -
    mediatek mt6753 -
    mediatek mt6755s -
    mediatek mt6757c -
    mediatek mt6757cd -
    mediatek mt6757ch -
    mediatek mt8163 -
    mediatek mt8167 -
    mediatek mt8167s -
    mediatek mt8173 -
    mediatek mt8183 -
    mediatek mt8321 -
    mediatek mt8362a -
    mediatek mt8385 -
    mediatek mt8518 -
    mediatek mt8532 -
    mediatek mt8765 -
    mediatek mt8788 -
    mediatek mt6580 -
    mediatek mt8167 -
    mediatek mt8183 -
    mediatek mt8362a -
    mediatek mt8385 -
    mediatek mt6735 -
    mediatek mt6737 -
    mediatek mt6739 -
    mediatek mt6750s -
    mediatek mt6753 -
    mediatek mt6755s -
    mediatek mt6757 -
    mediatek mt6757c -
    mediatek mt6757cd -
    mediatek mt6757ch -
    mediatek mt6763 -
    mediatek mt6771 -
    mediatek mt8163 -
    mediatek mt8167s -
    mediatek mt8173 -
    mediatek mt8321 -
    mediatek mt8532 -
    mediatek mt8765 -
    mediatek mt8788 -
    google android 10
    google android 11
    google android 12
    yoctoproject yocto 3.1