CVE-2025-20649: mediatek, inc. mt6880, mt6890, mt6980, mt6990, mt7663, mt7902, mt7925, mt7927, mt7961

Vulnerability summary

CVE-2025-20649 is a medium (CVSS 6.5) vulnerability in mediatek, inc. mt6880, mt6890, mt6980, mt6990, mt7663, mt7902, mt7925, mt7927, mt7961. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.3% of scored vulnerabilities.

Timeline

1. 03-03-2025
   PublishedVulnerability first disclosed.
2. 04-03-2025
   Last modifiedVulnerability information updated.

Description

In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00396437; Issue ID: MSV-2184.

• CWE-280Improper Handling of Insufficient Permissions or PrivilegesThe product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.