CVE-2025-20649 — Improper Handling of Insufficient Permissions or Privileges in Software Development KIT

CWE-280 — Improper Handling of Insufficient Permissions or Privileges3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 74.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mediatek Software Development KITOpenwrt
Timeline
PublishedMar 3

Description

In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00396437; Issue ID: MSV-2184.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDopenwrt/openwrt23.05

🔴Vulnerability Details

2
GHSA
GHSA-3xm4-5347-4q37: In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check↗2025-03-03
▶
CVEList
CVE-2025-20649: In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check↗2025-03-03
▶
CVE-2025-20649 — Software Development KIT vulnerability | cvebase