Black Hat Asia 2026 | Overkill: Hijacking a Wi-Fi 7 Chip for SYSTEM Privileges
Source: YouTube · Black Hat · published Aug 28, 2026 · 35:58
BLUF: Researchers demonstrated a rare firmware exploit on the MediaTek MT760 Wi-Fi 7 chipset, achieving 100% reliable code execution on the firmware and escalating to SYSTEM on Windows via an out-of-bounds write in the kernel driver 2:10.
Key Takeaways:
• The MT760 was chosen as a high-value target due to mass production (400M+ units); Windows firmware exploits are exceptionally rare 2:10
• A driver IOCTL allows user-mode writes to MMIO space, enabling direct access to the firmware's code section 11:22
• Using CSR registers, they found the firmware runs RISC-V with custom AndesStar-V5 extensions and uses Physical Memory Protection (PMP) 14:12
• The exploit chain uses an out-of-bounds write in the driver's calibration parser to overwrite the ntoskrnl.exe debug privilege for escalation 25:49
• A modified prefetch side-channel, using offsets from a leaked driver address, made kernel address leaking fully reliable 29:41
Firmware attacks bypass EDR and AV, creating a major blind spot for defenders 33:46. The talk challenges the assumption that the kernel-firmware boundary isn't a security boundary, even when both are controlled by the same vendor.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Let's get started. My name is Nikolas Laufer. I'm a graduate student at Zurich University of Applied Sciences, and this is Kurt Roggwil. He's a senior lecturer at Applied Sciences and my supervisor. Before we deep dive into firmware exploits, we have to actually define what is a firmware. Well, firmware is something which runs between hard and software because it's firm. So, basically, it's the code running the low-level code running on devices. In this talk, specifically, we're talking about the code which runs on your peripheral devices inside your PC. For example, your GPU, NPU, Wi-Fi chip, and so on. They're all running low-level code by themselves. What was our motivation to to hunt for firmware exploits? Well, for me, firmware exploits were always kind of unique. They were kind of a …