Samsung Exynos Firmware vulnerabilities

4 CVEs affecting Samsung Exynos Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21455, published 2023-03-16.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-39881, published 2022-11-09. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. Improper input validation vulnerability for processing SIB12 PDU in Exynos modems prior to SMR Sep-2022 Release allows remote attacker to read out of bounds memory.
• CVE-2022-39902, published 2022-12-08. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call.
• CVE-2023-21455, published 2023-03-16. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Improper authorization implementation in Exynos baseband prior to SMR Mar-2023 Release 1 allows incorrect handling of unencrypted message.
• CVE-2022-39901, published 2022-12-08. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption between UE and gNodeB.