InfoSecBulletin Cybersecurity for mankind
MediaTek has released its March 2025 Product Security Bulletin, which highlights new security vulnerabilities affecting various chipsets in smartphones, tablets, AIoT devices, smart displays, OTT hardware, computer vision platforms, audio systems, and smart TVs.
The bulletin reports 10 vulnerabilities, three of which are high severity. The high-severity ones could enable attackers to cause denial of service or escalate privileges.
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
Three high-severity vulnerabilities have been identified: CVE-2025-20644, CVE-2025-20645, and CVE-2025-20646. Each poses unique risks.
CVE-2025-20644 (Modem – Denial of Service)
Certain versions of Modem software have a syntactic error that can lead to memory corruption and cause remote denial of service (DoS). In severe cases, an attacker could take control of a rogue base station and disconnect a device without the user being aware.
CVE-2025-20645 (KeyInstall – Escalation of Privilege)
Missing bounds checks in KeyInstall can result in out-of-bounds writes. Although an attacker needs System privileges for local privilege escalation, this can lead to unauthorized code execution, compromising core system protections.
CVE-2025-20646 (wlan AP FW – Remote Escalation of Privilege)
A vulnerability in WLAN firmware could allow remote privilege escalation through out-of-bounds writes without any user interaction. This poses a significant risk for Wi-Fi devices in both consumer and enterprise environments.
The bulletin highlights that several popular chipsets, including the MT67xx, MT68xx, and MT69xx series, as well as AIoT solutions, are affected. MediaTek supplied patches to device manufacturers two months before the announcement, allowing them to release over-the-air updates and include fixes in system patches.
Users should promptly update their devices with the latest security updates.
Qualcomm’s March 2025 Security Bulletin Highlights Major Vulns
