---
id: CVE-2024-20017
title: >-
  In wlan service, there is a possible out of bounds write due to improper input
  validation
summary: >-
  In wlan service, there is a possible out of bounds write due to improper input
  validation. This could lead to remote code execution with no additional
  execution privileges needed. User interaction is not needed for exploitation
  Patch ID:…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-20
  - CWE-787
vendor: mediatek
product: software_development_kit
affected:
  - software_development_kit <= 7.4.0.1
  - software_development_kit <= 7.6.7.0
  - openwrt = 19.07.0
  - openwrt = 21.02.0
published: '2024-03-04'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:17:13.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-20017'
references:
  - url: 'https://corp.mediatek.com/product-security-bulletin/March-2024'
    label: security@mediatek.com
  - url: >-
      https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://blog.sonicwall.com/en-us/2024/09/critical-exploit-in-mediatek-wi-fi-chipsets-zero-click-vulnerability-cve-2024-20017-threatens-routers-and-smartphones/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://corp.mediatek.com/product-security-bulletin/March-2024'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://news.ycombinator.com/item?id=41605680'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2024-12-04T15:11:16.903495Z'
epss: 0.46609
epssPercentile: 0.98829
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/mellow-hype/cve-2024-20017'
  checkedAt: '2026-11-07T17:43:56.802Z'
ingestedAt: '2026-11-05T06:38:03.562Z'
---

## Overview

In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.

## Affected

- `software_development_kit <= 7.4.0.1`
- `software_development_kit <= 7.6.7.0`
- `openwrt = 19.07.0`
- `openwrt = 21.02.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.