CVE-2024-20040
In wlan firmware, there is a possible out of bounds write due to improper input validation. This...
In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08360153 (for MT6XXX chipsets) / WCNCR00363530 (for MT79XX chipsets); Issue ID: MSV-979.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08360153 (for MT6XXX chipsets) / WCNCR00363530 (for MT79XX chipsets); Issue ID: MSV-979.
- Record
CVE-2024-20040- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2024-17755
In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08360153 (for MT6XXX chipsets) / WCNCR00363530 (for MT79XX chipsets); Issue ID: MSV-979.
- Record
EUVD-2024-17755- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8rm5-h6c9-v86r
In wlan firmware, there is a possible out of bounds write due to improper input validation. This...
In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08360153 (for MT6XXX chipsets) / WCNCR00363530 (for MT79XX chipsets); Issue ID: MSV-979.
- Record
GHSA-8rm5-h6c9-v86r- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08360153 (for MT6XXX chipsets) / WCNCR00363530 (for MT79XX chipsets); Issue ID: MSV-979.
- Record
CVE-2024-20040- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
Affected products
- google android
- linux kernel
- linuxfoundation yocto
- mediatek mt2713
- mediatek mt6580
- mediatek mt6761
- mediatek mt6762
- mediatek mt6768
- mediatek mt6781
- mediatek mt6789
- mediatek mt6833
- mediatek mt6853
Show 39 moreShow less
- mediatek mt6853t
- mediatek mt6855
- mediatek mt6873
- mediatek mt6875
- mediatek mt6877
- mediatek mt6879
- mediatek mt6883
- mediatek mt6885
- mediatek mt6886
- mediatek mt6889
- mediatek mt6890
- mediatek mt6891
- mediatek mt6893
- mediatek mt6895
- mediatek mt6983
- mediatek mt6985
- mediatek mt6989
- mediatek mt6990
- mediatek mt7902
- mediatek mt7915
- mediatek mt7916
- mediatek mt7920
- mediatek mt7921
- mediatek mt7922
- mediatek mt7925
- mediatek mt7927
- mediatek mt7981
- mediatek mt7986
- mediatek mt8188
- mediatek mt8195
- mediatek mt8370
- mediatek mt8390
- mediatek mt8395
- mediatek mt8518s
- mediatek mt8532
- mediatek mt8673
- mediatek, inc. mt2713, mt6580, mt6761, mt6762, mt6768, mt6781, mt6789, mt6833, mt6853, mt6853t, mt6855, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6886, mt6889, mt6890, mt6891, mt6893, mt6895, mt6983, mt6985, mt6989, mt6990, mt7902, mt7915, mt7916, mt7920, mt7921, mt7922, mt7925, mt7927, mt7981, mt7986, mt8188, mt8195, mt8370, mt8390, mt8395, mt8518s, mt8532, mt8673, mt8678, mt8781, mt8791t, mt8792, mt8796, mt8797, mt8798
- openwrt
- rdkcentral rdk-b
Affected packages
| Package | Affected | Fixed |
|---|---|---|
:unknown:Android |
SoCVersion:0 up to SoCVersion:2024-04-05, plus listed versions SoCVersion |
SoCVersion:2024-04-05 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-20040 is a high vulnerability (CVSS 8.8) in Google Android, published April 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in :unknown: SoCVersion:2024-04-05.