Samsung Exynos vulnerabilities

4 CVEs affecting Samsung Exynos, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21467, published 2025-09-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-21517, published 2023-06-28. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. Heap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.
CVE-2020-10835, published 2020-03-24. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. An issue was discovered on Samsung mobile devices with any (before February 2020 for Exynos modem chipsets) software. There is a buffer overflow in baseband CP message decoding. The Samsung IDs are…
CVE-2020-25054, published 2020-08-31. Critical severity, CVSS 9.1. EPSS: 1.2% chance of exploitation in the next 30 days. An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets). There is a heap-based buffer over-read in the Shannon baseband. The Samsung ID is…
CVE-2023-21467, published 2025-09-03. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling of unencrypted message.