Read the docs
TI-2024-13044 Aliases CVE-2024-20006GHSA-grjc-q3pp-wg86

Out-of-bounds write in MediaTek MT2713, MT6781, MT6880, MT6890, MT8188T

Priority LOW 31CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08477148; Issue ID: ALPS08477148.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00223 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MediaTekMT2713, MT6781, MT6880, MT6890, MT8188TAndroid 11.0 / OpenWrt 19.07, 21.02 / RDK-B 22Q3—No fix listedCNA
  • MT2713, MT6781, MT6880, MT6890, MT8188T VendorMediaTek Affected Android 11.0 / OpenWrt 19.07, 21.02 / RDK-B 22Q3 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:rdkcentral:rdk-b:2022q3:*:*:*:*:*:*:*2022q3VulnerableRdkcentral
cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*11.0VulnerableGoogle
cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:*19.07.0Vulnerableopenwrt
cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*21.02.0Vulnerableopenwrt
cpe:2.3:h:mediatek:mt2713:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8188t:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
  • cpe:2.3:a:rdkcentral:rdk-b:2022q3:*:*:*:*:*:*:* Versions 2022q3 Vulnerable ·Rdkcentral
  • cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Google
  • cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:* Versions 19.07.0 Vulnerable ·openwrt
  • cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:* Versions 21.02.0 Vulnerable ·openwrt
  • cpe:2.3:h:mediatek:mt2713:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8188t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-20006
  2. 2026-10-03 Alias added: GHSA-grjc-q3pp-wg86

References

Advisory 1

  • TI-2020-00067 Out-of-bounds write in Android KEVCVSS 3.1HIGH 7.8
  • TI-2024-13053 Improper input validation in MediaTek MT6890, MT7915, MT7916, MT7981, MT7986 CVSS 3.1CRITICAL 9.8
  • TI-2025-14725 Integer overflow in MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT6886… CVSS 3.1MEDIUM 6.5
  • TI-2024-13114 Memory corruption in MediaTek MT2735, MT2737, MT6833, MT6835, MT6835T, MT6853, MT6855… CVSS 3.1CRITICAL 9.8
  • TI-2022-14283 Command injection in MediaTek EN7528, EN7580 CVSS 3.1CRITICAL 9.8
  • TI-2021-11684 Command injection in MediaTek EN7528, EN7580 CVSS 3.1CRITICAL 9.8
See all 1133 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences