CVE-2023-32831: mt6890 — Fix

Description

In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00325055; Issue ID: MSV-868.

Is your site exposed to CVE-2023-32831?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-330 CWE-330

Affected Products

Vendor	Product	Versions
mediatek	software_development_kit	< 7.6.7.1
mediatek	mt6890	All
mediatek	mt7612	All
mediatek	mt7613	All
mediatek	mt7615	All
mediatek	mt7622	All
mediatek	mt7626	All
mediatek	mt7629	All
mediatek	mt7915	All
mediatek	mt7916	All
mediatek	mt7981	All
mediatek	mt7986	All

References

Advisories & Patches

https://corp.mediatek.com/product-security-bulletin/January-2024 https://corp.mediatek.com/product-security-bulletin/January-2024

Frequently Asked Questions

What is CVE-2023-32831? +

In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00325055; Issue ID: MSV-868. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2023-32831? +

CVE-2023-32831 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2023-32831? +

CVE-2023-32831 affects products from mediatek, specifically: mt6890, mt7612, mt7613, mt7615, mt7622, mt7626, mt7629, mt7915, mt7916, mt7981, mt7986, software_development_kit. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-32831? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-81852

Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. …

CVE-2026-105786

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts …

CVE-2026-47703

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path …

CVE-2025-59371

An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability …

CVE-2025-13955

Predictable default Wi-Fi Password in Access Point functionality in EZCast Pro II version 1.17478.146 allows attackers in Wi-Fi range to …

CVE-2026-102719

Predictable DTLS HelloVerifyRequest Cookie in NetX Secure

CVE-2023-32831