CVE-2024-20148
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected devices via Wi-Fi without user interaction. It affects MediaTek chipsets with vulnerable STA (station) firmware in wireless LAN functionality. Attackers within Wi-Fi range can exploit this to take full control of devices.
💻 Affected Systems
- MediaTek Wi-Fi chipsets with vulnerable STA firmware
📦 What is this software?
Android by Google
Android by Google
Android by Google
Yocto by Linuxfoundation
Yocto by Linuxfoundation
Yocto by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent malware installation, data theft, and use as attack platform
Likely Case
Remote code execution leading to device takeover, credential theft, and lateral movement within network
If Mitigated
Limited impact with network segmentation and strict Wi-Fi security controls
🎯 Exploit Status
No authentication required, attacker needs proximity to target Wi-Fi network
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware patches identified as WCNCR00389045 / ALPS09136494
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/January-2025
Restart Required: Yes
Instructions:
1. Check device manufacturer for firmware updates 2. Apply MediaTek-provided firmware patches 3. Reboot device to activate new firmware
🔧 Temporary Workarounds
Disable Wi-Fi
linuxTurn off Wi-Fi functionality to prevent exploitation
nmcli radio wifi off
ip link set wlan0 down
Use Ethernet Only
allDisable wireless connectivity and use wired connections
🧯 If You Can't Patch
- Segment Wi-Fi networks and restrict device-to-device communication
- Implement strict network access controls and monitor for suspicious Wi-Fi activity
🔍 How to Verify
Check if Vulnerable:
Check device specifications for MediaTek Wi-Fi chipset and firmware version against vendor advisoryCheck Version:
dmesg | grep -i mediatek OR check device manufacturer's firmware version informationVerify Fix Applied:
Verify firmware version has been updated to include patches WCNCR00389045 or ALPS09136494📡 Detection & Monitoring
Log Indicators:
- Unexpected firmware crashes
- Wi-Fi driver errors
- Memory corruption warnings in system logs
Network Indicators:
- Unusual Wi-Fi probe requests
- Malformed Wi-Fi packets from unexpected sources
SIEM Query:
source="*kernel*" AND ("out of bounds" OR "OOB write" OR "wlan" AND "crash")