CVE-2024-20153

Description

In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08990446 / ALPS09057442; Issue ID: MSV-1598.

Reserved 2023-11-02 | Published 2025-01-06 | Updated 2025-01-06 | Assigner MediaTek

Problem types

CWE-304 Missing Critical Step in Authentication

Product status

Android 14.0, 15.0 / SDK release 3.5 and before / Yocto 3.3, 4.0, 5.0
affected

References

corp.mediatek.com/product-security-bulletin/January-2025

cve.org (CVE-2024-20153)

nvd.nist.gov (CVE-2024-20153)

Download JSON