CVE-2021-32467

Vulnerability

CVE-2021-32467 is an out-of-bounds read vulnerability in the WPS (Wi-Fi Protected Setup) protocol handling of MediaTek microchips. The affected chipsets include MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, and MT7915, running software version 7.4.0.0. The flaw resides in the WPS message parsing logic and can be triggered without authentication when a device processes a specially crafted WPS frame [1]. NETGEAR products using these chipsets are among the affected devices [2].

Exploitation

An attacker within Wi-Fi range of a vulnerable device can send a malicious WPS frame to trigger the out-of-bounds read. No prior authentication or user interaction is required. The attacker only needs network proximity to the target device [1][2].

Impact

Successful exploitation results in an out-of-bounds read, potentially leaking sensitive memory contents. This could lead to information disclosure, such as Wi-Fi credentials or other data stored in the device's memory. The vulnerability is rated Medium severity (CVSS v3.1) [1].

Mitigation

MediaTek notified device OEMs and provided patches [1]. NETGEAR released firmware updates for affected products, including extenders (e.g., EAX11v2, EX3700) and access points (e.g., WAC104, WAX202). Users should update to the latest firmware listed in the NETGEAR advisory [2]. No workarounds are available [2].