InfoSecBulletin Cybersecurity for mankind
MediaTek has released its March 2025 Product Security Bulletin, which highlights new security vulnerabilities affecting various chipsets in smartphones, tablets, AIoT devices, smart displays, OTT hardware, computer vision platforms, audio systems, and smart TVs.
The bulletin reports 10 vulnerabilities, three of which are high severity. The high-severity ones could enable attackers to cause denial of service or escalate privileges.
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed
ALERT
Thousands of IP addresses compromised nationwide: CIRT warn
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks
Critical RCE Flaw Patched in Roundcube Webmail
Hacker claim Leak of Deloitte Source Code & GitHub Credentials
CISA Issued Guidance for SIEM and SOAR Implementation
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
Three high-severity vulnerabilities have been identified: CVE-2025-20644, CVE-2025-20645, and CVE-2025-20646. Each poses unique risks.
CVE-2025-20644 (Modem – Denial of Service)
Certain versions of Modem software have a syntactic error that can lead to memory corruption and cause remote denial of service (DoS). In severe cases, an attacker could take control of a rogue base station and disconnect a device without the user being aware.
CVE-2025-20645 (KeyInstall – Escalation of Privilege)
Missing bounds checks in KeyInstall can result in out-of-bounds writes. Although an attacker needs System privileges for local privilege escalation, this can lead to unauthorized code execution, compromising core system protections.
CVE-2025-20646 (wlan AP FW – Remote Escalation of Privilege)
A vulnerability in WLAN firmware could allow remote privilege escalation through out-of-bounds writes without any user interaction. This poses a significant risk for Wi-Fi devices in both consumer and enterprise environments.
The bulletin highlights that several popular chipsets, including the MT67xx, MT68xx, and MT69xx series, as well as AIoT solutions, are affected. MediaTek supplied patches to device manufacturers two months before the announcement, allowing them to release over-the-air updates and include fixes in system patches.
Users should promptly update their devices with the latest security updates.
Qualcomm’s March 2025 Security Bulletin Highlights Major Vulns
