MediaTek Wi-Fi Research Demonstrates Remote Code Execution via Beacon Flaw

Summary

A Hexacon talk details reverse engineering of MediaTek Wi-Fi 6/7 firmware and kernel-module flaws, including unauthenticated frame injection and a beacon-triggered buffer overflow demonstrated for remote code execution. The presenter says all discussed issues have been.

Key points

• The study examined MediaTek Wi-Fi 6 and Wi-Fi 7 firmware and the Wi-Fi kernel module, including the MT7981, MT7976, AM7563 and MT7991 platforms.
• A Wi-Fi 6 MCU stack overflow found during testing was already patched in a newer firmware version; the presenter says chipset patches may not reach device firmware promptly.
• The presenter describes a missing authentication check in an accelerated frame-processing path that allows unauthenticated devices to inject data frames and potentially attack the access point’s network.
• The talk details kernel-module flaws in management-frame handling, including buffer overflows that can crash devices and, in some cases, allow remote code execution.
• A crafted beacon triggers a buffer overflow that the presenter used to develop an arbitrary-write primitive and overwrite a function pointer; the demonstration achieved code execution after repeated attempts.
• The presenter says the issues discussed have been fixed. The affected device model was withheld under MediaTek’s bug-bounty policy.

People

Vendors

Products