CVE-2026-23792 in Exynos
Summary
by MITRE • 09/14/2026
An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, Modem 5400, and Modem 5410. Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in Samsung Mobile Processor and Modem series including Exynos 1080 through 2500 as well as W1000, Modem 5300, 5400, and 5410 represents a critical flaw within the Radio Resource Control layer of the New Radio interface. This component is responsible for managing connections between user equipment and the cellular network infrastructure. The specific issue stems from an incorrect handling mechanism when processing unauthenticated downlink RRC Setup messages received by the baseband processor. In standard 5G NR operations, certain control plane signaling messages must undergo rigorous authentication and integrity verification before being processed to ensure they originate from a trusted source within the network. However, in this implementation, the device fails to adequately validate these specific setup messages prior to execution of associated logic routines.
This lack of proper validation allows malicious actors or compromised base stations to inject crafted RRC Setup messages that exploit parsing errors or state machine inconsistencies within the modem firmware. When such a malformed message is processed, it triggers an exception condition in the baseband software stack that is not gracefully handled by error recovery mechanisms. Consequently, this leads to a catastrophic failure of the baseband processor, resulting in a complete system crash. The device effectively becomes non-functional until power cycled or reset manually, disrupting all cellular connectivity and potentially affecting other subsystems dependent on stable modem operation for time synchronization and network registration services.
From a security architecture perspective, this flaw aligns with CWE-20 Improper Input Validation as the root cause lies in insufficient checking of incoming data structures against expected formats and authentication states. Furthermore, it relates to CWE-787 Out-of-bounds Write if the malformed message causes memory corruption leading to the crash, or CWE-400 Uncontrolled Resource Consumption if the processing loop enters an infinite state before crashing. In terms of adversary tactics, this vulnerability can be leveraged via Denial of Service attacks where an attacker uses a rogue base station or specialized radio equipment to broadcast malicious RRC messages targeting vulnerable devices in proximity. This corresponds to ATT&CK technique T1498 Network Denial of Service specifically within the context of wireless communication protocols and cellular infrastructure exploitation.
The operational impact extends beyond simple service interruption as repeated crashes can lead to battery drain due to constant reconnection attempts, potential data loss if active sessions are abruptly terminated without proper teardown procedures, and increased susceptibility to further attacks during recovery phases when security checks might be bypassed or weakened depending on the implementation of fallback modes. Additionally, in enterprise environments relying on Samsung devices for secure communications, such instability undermines trust in the hardware platform's resilience against sophisticated wireless-based threats.
Mitigation strategies primarily involve applying vendor-provided firmware updates that patch the RRC parsing logic to enforce strict authentication checks and input sanitization before processing downlink setup messages. Network operators should also ensure their base station equipment adheres strictly to 3GPP standards regarding message integrity protection for control plane signaling. Users of affected devices must keep their software up to date with security patches released by Samsung which address this specific handling defect in the modem stack. Until updates are applied, limiting exposure to untrusted radio environments and disabling automatic network selection features may reduce but not eliminate the risk as passive reception of broadcast messages can still trigger the vulnerability depending on implementation details.