CVE-2026-20447
Privilege Escalation in GenieZone Due to Missing Bounds Check
Publication date: 2026-05-04
Last updated on: 2026-05-07
Assigner: MediaTek, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mediatek | mt6768_firmware | * |
| mediatek | mt6789_firmware | * |
| mediatek | mt6877_firmware | * |
| mediatek | mt6899_firmware | * |
| mediatek | mt6989_firmware | * |
| mediatek | mt6991_firmware | * |
| mediatek | mt6993_firmware | * |
| mediatek | mt8196_firmware | * |
| mediatek | mt8367_firmware | * |
| mediatek | mt8766_firmware | * |
| mediatek | mt8768_firmware | * |
| mediatek | mt8781_firmware | * |
| mediatek | mt8786_firmware | * |
| mediatek | mt8788e_firmware | * |
| mediatek | mt8791t_firmware | * |
| mediatek | mt8793_firmware | * |
| mediatek | mt8910_firmware | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in geniezone and involves a possible escalation of privilege due to a missing bounds check.
A malicious actor who has already obtained System privilege could exploit this flaw to escalate their privileges further.
No user interaction is required for exploitation.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker with System privilege to escalate their privileges locally.
This could lead to unauthorized access to sensitive system functions or data, potentially compromising system security.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, apply the patch identified as ALPS10724073 provided by the vendor.
Since the vulnerability allows local escalation of privilege due to a missing bounds check, ensure that only trusted users have System privilege access to reduce risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in geniezone allows for local escalation of privilege if a malicious actor already has System privilege. This could potentially lead to unauthorized access or modification of sensitive data, which may impact compliance with standards like GDPR or HIPAA that require strict controls on data confidentiality, integrity, and access.
However, the provided information does not explicitly describe the direct impact on compliance with these regulations or mention any specific compliance risks.