VulnerabilityAnalyzed

CVE-2025-20658

In DA, there is a possible permission bypass due to a logic error.

MEDIUM 6.0EPSS 0.11%

Does this matter?

Lower severity and a low EPSS score (0.11%). Track it; it rarely justifies an emergency change on its own.

Description

In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09474894; Issue ID: MSV-2597.

CVSS 3.1: 6.0 MEDIUMCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS: 0.11% probability · 2th percentile
CISA KEV: Not listed
Weakness: CWE-787
Affected: google/android · mediatek/mt2718 · mediatek/mt6781 · mediatek/mt6789 · mediatek/mt6835 · mediatek/mt6855 · mediatek/mt6878 · mediatek/mt6879 · mediatek/mt6886 · mediatek/mt6895 · mediatek/mt6897 · mediatek/mt6983 · mediatek/mt6985 · mediatek/mt6989 · mediatek/mt8196 · mediatek/mt8673 · mediatek/mt8676 · mediatek/mt8678 · mediatek/mt8781
Source: security@mediatek.com

References

https://corp.mediatek.com/product-security-bulletin/April-2025Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.