CVE-2024-20069: mediatek, inc. mt6833, mt6853, mt6855, mt6873, mt6875, mt6875t, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8675, mt8771, mt8791t, mt8797 Algorithm Downgrade

Vulnerability summary

CVE-2024-20069 is a medium (CVSS 6.5) Algorithm Downgrade vulnerability in mediatek, inc. mt6833, mt6853, mt6855, mt6873, mt6875, mt6875t, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8675, mt8771, mt8791t, mt8797. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.5% of scored vulnerabilities.

Timeline

1. 03-06-2024
   PublishedVulnerability first disclosed.
2. 01-08-2024
   Last modifiedVulnerability information updated.

Description

In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01286330; Issue ID: MSV-1430.

• CWE-757Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.