CVE-2025-66366 in Exynos 1280
Summary
by MITRE • 11/05/2026
Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability described involves a critical flaw in the Radio Resource Control protocol implementation within cellular network infrastructure, specifically affecting the baseband processing unit. This issue arises from the improper validation and state management of Unicast Random Access Channel setup requests initiated by user equipment without prior authentication or security context establishment. In standard Long Term Evolution and 5G New Radio architectures, the initial access procedure requires specific sequencing where a User Equipment sends a RRC Setup Request to establish a connection with the base station. The flaw lies in how the network side processes these messages when they arrive under unexpected conditions or contain malformed parameters that bypass expected sanity checks before security context is fully negotiated. This lack of rigorous input validation allows an attacker, positioned within radio range and capable of transmitting crafted RRC Setup messages, to trigger a buffer overflow, integer overflow, or logic error in the baseband processor's memory management subsystems.
From a technical perspective, this vulnerability represents a classic case of improper input handling leading to denial of service conditions at the hardware abstraction layer. The baseband modem is responsible for real-time signal processing and protocol stack execution, which demands high stability and low latency. When an unauthenticated downlink or uplink RRC Setup message with maliciously crafted fields reaches the vulnerable component, it can corrupt internal data structures used to track connection states. This corruption may lead to a kernel panic or a hard reset of the modem firmware, effectively crashing the baseband processor. Such crashes disrupt all active connections on that cell sector and require manual intervention or remote reboot procedures to restore service, creating a significant operational disruption for mobile network operators.
The impact of this vulnerability is severe in terms of availability, which is one of the three pillars of information security alongside confidentiality and integrity. An attacker can exploit this flaw to perform a Denial of Service attack against specific cell towers or base stations without needing any credentials or prior authentication with the network. This capability undermines the reliability of mobile communications services provided by telecommunications providers. In high-density urban areas or critical infrastructure zones, such disruptions could affect emergency services, public safety networks, and general consumer connectivity. Furthermore, repeated crashes can lead to increased wear on hardware components due to frequent reboots and may mask more sophisticated attacks that rely on timing windows created during system recovery phases.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-20 Improper Input Validation and potentially CWE-400 Uncontrolled Resource Consumption if the crash results from resource exhaustion triggered by malformed messages. In terms of offensive security frameworks, this exploit technique maps to MITRE ATT&CK tactic TA0004 Impact, specifically subtechniques related to Denial of Service such as T1499 Endpoint Denial of Service or network-level disruptions like T1498 Network Denial of Service depending on the scope. The attack vector is classified as Local with Physical requirements since it requires proximity to transmit radio signals, but the privilege required is None for an unauthenticated attacker.
Mitigation strategies must focus on both immediate operational controls and long-term architectural fixes. Operators should implement strict filtering rules at the Radio Access Network level to drop or flag anomalous RRC messages that deviate from expected protocol standards before they reach the vulnerable baseband processing units. Firmware updates provided by equipment vendors are critical, as they typically include patches for input validation logic in the protocol stack implementation. Additionally, deploying intrusion detection systems capable of analyzing radio layer signaling can help identify and block malicious traffic patterns associated with this exploit. Regular auditing of modem firmware versions and ensuring timely application of security patches from hardware manufacturers remain essential practices to maintain network resilience against such low-level protocol exploitation attempts.