---
id: "CVE-2020-0069"
kind: "vulnerability"
aliases: ["CVE-2020-0069"]
title: "MediaTek Multiple Chipsets: Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.0137
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "MediaTek Multiple Chipsets", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["android", "exploited", "infrastructure", "mediatek", "mobile-devices"]
not_affected_if: ["non-mediatek-chipset", "patched-firmware"]
published_at: "2020-03-10T20:15:21+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0069", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-0069", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0069", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# MediaTek Multiple Chipsets: Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability

A flaw in MediaTek chipset Command Queue driver ioctl handlers lets a process write out of bounds because input is not validated and SELinux does not restrict access. An attacker who already runs code on the device can escalate to higher privileges, and it was used in the wild chained with other bugs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MediaTek Multiple Chipsets affected ? fixed ?

## Fix

Apply the MediaTek chipset security update for the device, per vendor instructions as CISA directs. Exact patched versions: unknown.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0069
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-0069
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-0069

## From the sources

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_