Read the docs
TI-2026-16562 Aliases CVE-2026-20419GHSA-4q2v-rcwc-rv6w

Improper check for unusual conditions in MediaTek chipset

Priority LOW 30CWE-754Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

In wlan AP/STA firmware, there is a possible system becoming irresponsive due to an uncaught exception. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461663 / WCNCR00463309; Issue ID: MSV-4852.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00777 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MediaTekMediaTek chipsetMT6890; MT6989TB; MT7902; MT7915; MT7916; MT7920; MT7921; MT7922; MT7925; MT7927; MT7981; MT7986; MT8196; MT8668; MT8676; MT8678; MT8775; MT8791T; MT8792; MT8793; MT8796; MT8873; MT8883; MT8893; MT8910—No fix listedCNA
  • MediaTek chipset VendorMediaTek Affected MT6890; MT6989TB; MT7902; MT7915; MT7916; MT7920; MT7921; MT7922; MT7925; MT7927; MT7981; MT7986; MT8196; MT8668; MT8676; MT8678; MT8775; MT8791T; MT8792; MT8793; MT8796; MT8873; MT8883; MT8893; MT8910 Fixed in — No fix listed CNA

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:mediatek:nbiot_sdk:*:*:*:*:*:*:*:*up to 3.6VulnerableMediaTek
cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*up to 7.6.7.2VulnerableMediaTek
cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt6989tb:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt7902:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt7920:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt7921:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt7922:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
  • cpe:2.3:a:mediatek:nbiot_sdk:*:*:*:*:*:*:*:* Versions up to 3.6 Vulnerable ·MediaTek
  • cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:* Versions up to 7.6.7.2 Vulnerable ·MediaTek
  • cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt6989tb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt7902:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt7920:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt7921:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt7922:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:mediatek:mt7925:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt7927:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:*19.07.0Vulnerableopenwrt
cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*21.02.0Vulnerableopenwrt
  • cpe:2.3:h:mediatek:mt7925:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt7927:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:* Versions 19.07.0 Vulnerable ·openwrt
  • cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:* Versions 21.02.0 Vulnerable ·openwrt

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-20419
  2. 2026-10-03 Alias added: GHSA-4q2v-rcwc-rv6w

References

Advisory 1

  • TI-2022-09785 Use of uninitialized resource in MediaTek MT2621, MT2625 CVSS 3.1CRITICAL 9.8
  • TI-2025-14750 Heap-based buffer overflow in MediaTek MT7902, MT7920, MT7921, MT7922, MT7925, MT7927 CVSS 3.1CRITICAL 9.8
  • TI-2026-16550 Out-of-bounds write in MediaTek chipset CVSS 3.1CRITICAL 9.3
  • TI-2026-16566 Out-of-bounds write in MediaTek chipset CVSS 3.1HIGH 7.8
  • TI-2026-16579 Buffer overflow in MediaTek chipset CVSS 3.1MEDIUM 6.7
  • TI-2025-14757 Out-of-bounds read in MediaTek MT7902, MT7920, MT7921, MT7922, MT7925, MT7927 CVSS 3.1MEDIUM 5.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences