This vulnerability, identified as CWE-201 (Insertion of Sensitive Information Into Sent Data), exists in the TFA component of MediaTek chipsets. It arises from a missing permission check that could lead to local information disclosure if a malicious actor has obtained System-level privileges. The vulnerability does not require user interaction to be exploited. The CVSS v3.1 base score is 4.4, reflecting a medium severity with local attack vector, low attack complexity, high privileges required, no user interaction, and impact limited to confidentiality. No official patch or remediation level has been published yet, and no known exploits are reported in the wild. The affected products include a broad range of MediaTek chipset models as listed.

An attacker with System privileges on a device using the affected MediaTek chipsets could exploit this vulnerability to disclose sensitive information locally. There is no impact on integrity or availability, and no user interaction is required for exploitation. The confidentiality impact is high, but the requirement for System privileges limits the risk to scenarios where the attacker already has significant access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users and administrators should monitor MediaTek advisories for updates. Because exploitation requires System privileges, maintaining strict access controls and limiting privilege escalation opportunities can reduce risk until a patch is available.