CVE-2024-20069 Overview
CVE-2024-20069 is an information disclosure vulnerability in MediaTek modem firmware affecting the Voice over Wi-Fi (VoWiFi) Internet Key Exchange (IKE) implementation. The modem fails to validate Diffie-Hellman (DH) group parameters during IKE negotiation, allowing a network-positioned attacker to force selection of a weaker cryptographic algorithm. This downgrade enables remote information disclosure without requiring additional execution privileges. The flaw is tracked by MediaTek as Patch ID MOLY01286330 and Issue ID MSV-1430, and is categorized under [CWE-757] Selection of Less-Secure Algorithm During Negotiation.
Critical Impact
A network attacker within range of a victim's VoWiFi session can downgrade IKE cryptographic parameters and passively decrypt or expose sensitive voice signaling data.
Affected Products
- MediaTek NR15 modem platform
- MediaTek Dimensity and Helio chipsets: MT6833, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893
- MediaTek smart platform chipsets: MT8675, MT8771, MT8791T, MT8797
Discovery Timeline
- 2024-06-03 - CVE-2024-20069 published to the National Vulnerability Database
- June 2024 - MediaTek releases security patch through the MediaTek Security Bulletin June 2024
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-20069
Vulnerability Analysis
The vulnerability resides in the MediaTek modem's IKE negotiation logic used to establish IPsec tunnels for VoWiFi. IKE peers negotiate parameters including the Diffie-Hellman group used to derive shared secrets. A properly hardened client rejects proposals that offer a DH group weaker than the one the client originally advertised or previously negotiated. The MediaTek modem omits this downgrade check. An attacker on the Wi-Fi path or upstream network can therefore inject or modify IKE_SA_INIT responses that propose a weaker DH group, and the modem accepts the negotiation.
Because VoWiFi signaling traverses the operator's Evolved Packet Data Gateway (ePDG) over untrusted networks, the confidentiality of the tunnel depends entirely on IKE parameter strength. Downgrading to a low-strength DH group makes the resulting session key vulnerable to offline cryptanalysis, exposing SIP signaling, IMSI values, and call metadata.
Root Cause
The root cause is a missing validation step in the modem's IKE state machine that should compare the DH group in the peer's SA payload against the client's minimum acceptable strength. Without this check, the initiator honors any group returned by the responder, including deprecated modular exponential (MODP) groups. This maps to [CWE-757] Selection of Less-Secure Algorithm During Negotiation.
Attack Vector
Exploitation requires network adjacency to the VoWiFi IKE exchange. An attacker operating a rogue Wi-Fi access point, performing ARP spoofing on a shared network, or holding an upstream position between the device and the ePDG can rewrite IKE_SA_INIT messages to advertise a weak DH group. The modem completes the handshake using the downgraded parameter. User interaction is limited to the victim initiating or receiving a call over VoWiFi. No credentials or on-device privileges are required.
No public proof-of-concept exploit is available. Refer to the MediaTek Security Bulletin June 2024 for vendor-authored technical details.
Detection Methods for CVE-2024-20069
Indicators of Compromise
- IKE_SA_INIT exchanges to the operator ePDG that negotiate legacy MODP DH groups (for example groups 1, 2, or 5) instead of the operator's expected group.
- Unexpected retransmissions or SA rekey events on UDP ports 500 and 4500 originating from mobile clients on enterprise Wi-Fi.
- Presence of unauthorized SSIDs mimicking corporate or carrier Wi-Fi networks in proximity to affected devices.
Detection Strategies
- Capture IKEv2 traffic at the network perimeter and alert on Security Association payloads offering DH groups below the operator's baseline.
- Correlate rogue AP detections from wireless intrusion detection systems with mobile device VoWiFi connection events.
- Baseline the DH group used by managed mobile fleets against the operator's published VoWiFi profile and flag deviations.
Monitoring Recommendations
- Monitor MDM inventory for MediaTek chipset models listed in the affected products and track patch level against the June 2024 bulletin.
- Log wireless authentication anomalies and evil-twin AP detections in the SIEM for correlation with IKE downgrade indicators.
- Track carrier-published VoWiFi client versions and firmware advisories to identify devices still exposed.
How to Mitigate CVE-2024-20069
Immediate Actions Required
- Apply the vendor firmware update containing Patch ID MOLY01286330 as delivered through OEM security updates.
- Inventory mobile devices using the affected MediaTek chipsets and prioritize update deployment for executives and high-risk users.
- Disable VoWiFi on unpatched devices where feasible, and require voice calls over the cellular radio until firmware is updated.
Patch Information
MediaTek addressed the missing DH downgrade check in the June 2024 Security Bulletin under Patch ID MOLY01286330 and Issue ID MSV-1430. The fix is distributed to device manufacturers who integrate it into monthly Android security updates. Consult the MediaTek Security Bulletin June 2024 and the OEM's security update notes for device-specific availability.
Workarounds
- Restrict use of VoWiFi to trusted, WPA3-protected Wi-Fi networks under organizational control.
- Enforce mobile device management policies that block connection to open or unauthenticated SSIDs.
- Educate users to disable Wi-Fi Calling on public networks such as hotels, cafes, and airports until firmware updates are installed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.