Out-of-Bounds Write in CCCI Modem Enables Local Priv Escalation
CVE-2023-32840 Published on November 6, 2023

In modem CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction may be also needed for exploitation Patch ID: MOLY01138425; Issue ID: MOLY01138425 (MSV-862).

NVD

Vulnerability Analysis

CVE-2023-32840 is exploitable with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:

LOCAL

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Weakness Type

What is a Memory Corruption Vulnerability?

The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.

CVE-2023-32840 has been classified to as a Memory Corruption vulnerability or weakness.

Products Associated with CVE-2023-32840

Want to know whenever a new CVE is published for MediaTek products? stack.watch will email you.

MediaTek Lr12a

MediaTek Nr15

MediaTek Nr16

MediaTek Nr17

Affected Versions

MediaTek, Inc. MT2731, MT2735, MT6731, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6769T, MT6769Z, MT6771, MT6771T, MT6813, MT6833, MT6833P, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6877T, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895T, MT6896, MT6897, MT6980, MT6980D, MT6983T, MT6983W, MT6983Z, MT6985, MT6985T, MT6989, MT6990, MT8666, MT8667, MT8673, MT8675, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797, MT8798:

Version Modem LR12A, NR15, NR16, VMOLYN, NR17 is affected.

mediatek mt2731:

Before and including * is affected.

mediatek mt2735:

Before and including * is affected.

mediatek mt6731:

Before and including * is affected.

mediatek mt6739:

Before and including * is affected.

mediatek mt6761:

Before and including * is affected.

mediatek mt6762:

Before and including * is affected.

mediatek mt6763:

Before and including * is affected.

mediatek mt6765:

Before and including * is affected.

mediatek mt6767:

Before and including * is affected.

mediatek mt6768:

Before and including * is affected.

mediatek mt6769:

Before and including * is affected.

mediatek mt6769t:

Before and including * is affected.

mediatek mt6769z:

Before and including * is affected.

mediatek mt6771:

Before and including * is affected.

mediatek mt6771t:

Before and including * is affected.

mediatek mt6813:

Before and including * is affected.

mediatek mt6833:

Before and including * is affected.

mediatek mt6833p:

Before and including * is affected.

mediatek mt6835:

Before and including * is affected.

mediatek mt6853:

Before and including * is affected.

mediatek mt6853t:

Before and including * is affected.

mediatek mt6855:

Before and including * is affected.

mediatek mt6873:

Before and including * is affected.

mediatek mt6875:

Before and including * is affected.

mediatek mt6877:

Before and including * is affected.

mediatek mt6877t:

Before and including * is affected.

mediatek mt6878:

Before and including * is affected.

mediatek mt6879:

Before and including * is affected.

mediatek mt6880:

Before and including * is affected.

mediatek mt6883:

Before and including * is affected.

mediatek mt6885:

Before and including * is affected.

mediatek mt6886:

Before and including * is affected.

mediatek mt6889:

Before and including * is affected.

mediatek mt6890:

Before and including * is affected.

mediatek mt6891:

Before and including * is affected.

mediatek mt6893:

Before and including * is affected.

mediatek mt6895:

Before and including * is affected.

mediatek mt6895t:

Before and including * is affected.

mediatek mt6896:

Before and including * is affected.

mediatek mt6897:

Before and including * is affected.

mediatek mt6980:

Before and including * is affected.

mediatek mt6980d:

Before and including * is affected.

mediatek mt6983t:

Before and including * is affected.

mediatek mt6983w:

Before and including * is affected.

mediatek mt6983z:

Before and including * is affected.

mediatek mt6985:

Before and including * is affected.

mediatek mt6985t:

Before and including * is affected.

mediatek mt6989:

Before and including * is affected.

mediatek mt6990:

Before and including * is affected.

mediatek mt8666:

Before and including * is affected.

mediatek mt8667:

Before and including * is affected.

mediatek mt8673:

Before and including * is affected.

mediatek mt8675:

Before and including * is affected.

mediatek mt8765:

Before and including * is affected.

mediatek mt8766:

Before and including * is affected.

mediatek mt8768:

Before and including * is affected.

mediatek mt8781:

Before and including * is affected.

mediatek mt8786:

Before and including * is affected.

mediatek mt8788:

Before and including * is affected.

mediatek mt8789:

Before and including * is affected.

mediatek mt8791:

Before and including * is affected.

mediatek mt8791t:

Before and including * is affected.

mediatek mt8797:

Before and including * is affected.

mediatek mt8798:

Before and including * is affected.

Exploit Probability

EPSS

0.03%

Percentile

8.39%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.

Out-of-Bounds Write in CCCI Modem Enables Local Priv EscalationCVE-2023-32840 Published on November 6, 2023

Vulnerability Analysis

Weakness Type

What is a Memory Corruption Vulnerability?

Products Associated with CVE-2023-32840

Affected Versions

Exploit Probability

Out-of-Bounds Write in CCCI Modem Enables Local Priv Escalation
CVE-2023-32840 Published on November 6, 2023