Unprivileged iwpriv Execution for MediaTek LPE

Tim Peck@timpeck

•updated Dec 23, 2025•1•0•43

Detects the execution of the `iwpriv` utility by an unprivileged user targeting subcommands that are vulnerable to Local Privilege Escalation (LPE) in certain MediaTek Wi-Fi drivers. The exploitation of these vulnerabilities is demonstrated to be possible by unprivileged users, making the execution of kernel-level configuration tools like `iwpriv` by non-root users a highly suspicious activity.