{"id":"CVE-2020-0069","published":"2020-03-10T20:15:21Z","modified":"2026-06-17T02:45:11Z","title":"Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability","vendor":"MediaTek","product":"Multiple Chipsets","tier":"core","eol":null,"description":{"text":"In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an insufficient input validation issue in the ioctl handlers of the Command Queue driver in MediaTek's multiple chipsets, affecting the Android kernel, and it allows an out-of-bounds write. An attacker with local access and low privileges can exploit it to escalate privileges without user interaction, since missing SELinux restrictions and inadequate input sanitization are involved and no additional execution privileges are required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:45Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.0137,"percentile":0.71817,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0069","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-10-28","exploitedFirstSeen":"2021-10-28","ransomware":false,"evidence":[{"url":"https://www.lookout.com/threat-intelligence/article/lookout-discovers-global-rooting-malware-campaign","date":"2021-10-28"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en","tags":["Vendor Advisory"]},{"url":"https://source.android.com/security/bulletin/2020-03-01","tags":["Vendor Advisory"]},{"url":"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-mtk-en","tags":["Vendor Advisory"]},{"url":"https://source.android.com/security/bulletin/2020-03-01","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0069","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Input Validation","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2020-0069 is an insufficient input validation vulnerability in multiple MediaTek chipsets that, combined with missing SELinux restrictions in the Command Queue drivers' ioctl handlers, allows an adversary to perform an out-of-bounds write leading to privilege escalation.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-1576","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-1576","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2019-09-06","earliestUrl":"https://github.com/R0rt1z2/AutomatedRoot","repos":[{"name":"R0rt1z2/AutomatedRoot","url":"https://github.com/R0rt1z2/AutomatedRoot","stars":188,"created":"2019-09-06"},{"name":"quarkslab/CVE-2020-0069_poc","url":"https://github.com/quarkslab/CVE-2020-0069_poc","stars":111,"created":"2020-03-24"},{"name":"TheRealJunior/mtk-su-reverse-cve-2020-0069","url":"https://github.com/TheRealJunior/mtk-su-reverse-cve-2020-0069","stars":17,"created":"2020-03-03"},{"name":"0xf15h/mtk_su","url":"https://github.com/0xf15h/mtk_su","stars":14,"created":"2023-09-04"}]},"first":{"date":"2019-09-06","source":"PoC-in-GitHub","url":"https://github.com/R0rt1z2/AutomatedRoot"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"}],"timeline":[{"date":"2019-09-06","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/R0rt1z2/AutomatedRoot","provenance":"source"},{"date":"2020-03-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0069","provenance":"source"},{"date":"2021-10-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.lookout.com/threat-intelligence/article/lookout-discovers-global-rooting-malware-campaign","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-1576","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":603},"priority":{"score":62.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1827 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.36,"detail":"percentile 0.7182"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}