InfoSecBulletin Cybersecurity for mankind
MediaTek has released its March 2025 Product Security Bulletin, which highlights new security vulnerabilities affecting various chipsets in smartphones, tablets, AIoT devices, smart displays, OTT hardware, computer vision platforms, audio systems, and smart TVs.
The bulletin reports 10 vulnerabilities, three of which are high severity. The high-severity ones could enable attackers to cause denial of service or escalate privileges.
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
Three high-severity vulnerabilities have been identified: CVE-2025-20644, CVE-2025-20645, and CVE-2025-20646. Each poses unique risks.
CVE-2025-20644 (Modem – Denial of Service)
Certain versions of Modem software have a syntactic error that can lead to memory corruption and cause remote denial of service (DoS). In severe cases, an attacker could take control of a rogue base station and disconnect a device without the user being aware.
CVE-2025-20645 (KeyInstall – Escalation of Privilege)
Missing bounds checks in KeyInstall can result in out-of-bounds writes. Although an attacker needs System privileges for local privilege escalation, this can lead to unauthorized code execution, compromising core system protections.
CVE-2025-20646 (wlan AP FW – Remote Escalation of Privilege)
A vulnerability in WLAN firmware could allow remote privilege escalation through out-of-bounds writes without any user interaction. This poses a significant risk for Wi-Fi devices in both consumer and enterprise environments.
The bulletin highlights that several popular chipsets, including the MT67xx, MT68xx, and MT69xx series, as well as AIoT solutions, are affected. MediaTek supplied patches to device manufacturers two months before the announcement, allowing them to release over-the-air updates and include fixes in system patches.
Users should promptly update their devices with the latest security updates.
Qualcomm’s March 2025 Security Bulletin Highlights Major Vulns
