CVE-2025-20674CWE-863

In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check

Critical · published June 2, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

🚨 An unguarded entry point in the wlan AP driver could let an attacker inject any packet they choose, no user interaction needed! 🔥 Think of it like a restaurant with a back door that anyone can walk through to change the menu — no password, no questions asked! An unverified packet can sneak into the network and cause mayhem, just like a rogue chef making surprise dishes. This vulnerability could allow an attacker to escalate privileges remotely, potentially gaining control over your entire network. The consequences could be absolutely devastating, with the ability to manipulate data, intercept communications, and wreak havoc without anyone knowing until it’s too late!

Put simply

Think of it like a restaurant with a back door that anyone can walk through to change the menu — no password, no questions asked! An unverified packet can sneak into the network and cause mayhem, just like a rogue chef making surprise dishes. The flaw stems from a missing permission check in the wlan AP driver, allowing an attacker to inject arbitrary packets without needing any additional execution privileges. This means they can take control with just the right commands sent through the network.

What to do

This vulnerability could allow an attacker to escalate privileges remotely, potentially gaining control over your entire network. The consequences could be absolutely devastating, with the ability to manipulate data, intercept communications, and wreak havoc without anyone knowing until it’s too late! Immediate action is required! Patch your system with WCNCR00413202 to close this gap and ensure that your devices verify permissions correctly. Regularly review your network settings and monitor for any unusual activity. You've got this! Follow these steps and you'll be well on your way to securing your network like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00765 · 54.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-06-02T02:29Z
EPSS history
Timeline
  • 02 JUN 02:29Z
    In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check
    cvelistv5