CVE-2023-20819

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: MOLY01068234; Issue ID: ALPS08010003.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
MediaTek, Inc.MT2731, MT6570, MT6580, MT6595, MT6732, MT6735, MT6737, MT6737M, MT6738, MT6739, MT6750, MT6750S, MT6752, MT6753, MT6755, MT6757, MT6758, MT6761, MT6762, MT6762D, MT6762M, MT6763, MT6765, MT6765T, MT6Modem LR11, LR12A, LR13, NR15, NR16, NR17
mediatekmt2731<= *
mediatekmt6570<= *
mediatekmt6580<= *
mediatekmt6595<= *
mediatekmt6732<= *
mediatekmt6735<= *
mediatekmt6737<= *
mediatekmt6737m<= *
mediatekmt6738<= *
mediatekmt6739<= *
mediatekmt6750<= *
mediatekmt6750s<= *
mediatekmt6752<= *
mediatekmt6753<= *
mediatekmt6755<= *
mediatekmt6757<= *
mediatekmt6758<= *
mediatekmt6761<= *
mediatekmt6762<= *
mediatekmt6762d<= *
mediatekmt6762m<= *
mediatekmt6763<= *
mediatekmt6765<= *
mediatekmt6765t<= *
mediatekmt6767<= *
mediatekmt6768<= *
mediatekmt6769<= *
mediatekmt6769t<= *
mediatekmt6769z<= *
mediatekmt6771<= *
mediatekmt6775<= *
mediatekmt6779<= *
mediatekmt6781<= *
mediatekmt6783<= *
mediatekmt6785<= *
mediatekmt6785t<= *
mediatekmt6789<= *
mediatekmt6795<= *
mediatekmt6797<= *
mediatekmt6799<= *
mediatekmt6813<= *
mediatekmt6815<= *
mediatekmt6833<= *
mediatekmt6835<= *
mediatekmt6853<= *
mediatekmt6855<= *
mediatekmt6873<= *
mediatekmt6875<= *
mediatekmt6875t<= *

References

Timeline

Published
Oct 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-20825.4The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and includingCVE-2023-208207.2In wlan service, there is a possible command injection due to improper input validation. This could lead to remote code execution with SysteCVE-2023-208216.7In nvram, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SysteCVE-2023-208226.7In netdagent, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SCVE-2023-208234.4In cmdq, there is a possible out of bounds read due to an incorrect status check. This could lead to local denial of service with System exeCVE-2023-208245.5In duraspeed, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure CVE-2023-208255.5In duraspeed, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure CVE-2023-208265.5In cta, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with nCVE-2023-208276.4In ims service, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System CVE-2023-208286.7In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System CVE-2023-208296.7In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System CVE-2023-20834.3The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save f
CVE-2023-20819: Critical severity, CVSS 9.8 | Vulnix