CVE-2025-20720

HIGH

MediaTek Software Development Kit - Heap-based Buffer Overflow in WLAN AP Driver

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-20720. PoCs published by shinthink.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-20720, a critical unauthenticated file upload vulnerability in Magento 2 / Adobe Commerce (≤ 2.4.8). The exploit leverages the guest cart REST API to upload a GIF89a polyglot PHP file, bypassing MIME validation and achieving remote code execution.

Description

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418954; Issue ID: MSV-3569.

Exploits (1)

github WORKING POC 1 stars

by shinthink · pythonpoc

https://github.com/shinthink/CVE-2025-20720

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2025-20720, a critical unauthenticated file upload vulnerability in Magento 2 / Adobe Commerce (≤ 2.4.8). The exploit leverages the guest cart REST API to upload a GIF89a polyglot PHP file, bypassing MIME validation and achieving remote code execution.

Classification

Working Poc 98%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Magento 2 / Adobe Commerce ≤ 2.4.8

No auth needed

Prerequisites: Target must be running a vulnerable version of Magento 2 / Adobe Commerce (≤ 2.4.8) · Access to the guest cart REST API endpoint · A valid product SKU (discovered via GraphQL or REST API)

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jul 10, 2026 Full analysis →

References (1)

Core 1

Core References

Vendor Advisory

https://corp.mediatek.com/product-security-bulletin/October-2025

Scores

CVSS v3 8.8

EPSS 0.0024

EPSS Percentile 15.6%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-122 CWE-787

Status published

Products (3)

mediatek/software_development_kit < 7.6.7.2

openwrt/openwrt 19.07.0

openwrt/openwrt 21.02.0

Published Oct 14, 2025

Tracked Since Feb 18, 2026