MediaTek, Inc. MediaTek chipset
At a glance
- Source
- NVD
- EPSS
- EPSS 0.12 % · percentile 2 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- MediaTek
- NVD status
- Analyzed
Description
In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.
Weaknesses (CWE)
- CWE-522 — Insufficiently Protected Credentials
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.6 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 4.6 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-9160
- GCVE · GCVE-0-2026-20435
CERT-FR advisories
- CERTFR-2026-AVI-0679 — Multiples vulnérabilités dans Google Android · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:linuxfoundation:yocto:4.0:*:*:*:*:*:*:*cpe:2.3:a:rdkcentral:rdk-b:2022q3:*:*:*:*:*:*:*cpe:2.3:a:rdkcentral:rdk-b:2024q1:*:*:*:*:*:*:*cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*cpe:2.3:o:openwrt:openwrt:23.05.0:-:*:*:*:*:*:*cpe:2.3:o:zephyrproject:zephyr:3.7.0:-:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| MediaTek, Inc. · MediaTek chipset | affected MT2737 ; affected MT6739 ; affected MT6761 ; affected MT6765 ; affected MT6768 ; affected MT6781 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |