CVE-2023-37366: Samsung Exynos denial of service in Shannon SM Task

CVE-2023-37366 · Severity: low · CVSS 2.8 · Published 2026-09-14

Samsung's Exynos processor family is used across millions of mobile devices and vehicles. A flaw in the Shannon SM Task component can be triggered via a malformed message to enter an infinite loop, causing the service to hang and become unresponsive. This results in a denial of service, potentially affecting device functionality until the processor is rebooted.

Technologies: Samsung Exynos 1080, Samsung Exynos 1280, Samsung Exynos 1330, Samsung Exynos 1380, Samsung Exynos 2100, Samsung Exynos 2200, Samsung Exynos 850, Samsung Exynos 9110, Samsung Exynos 980, Samsung Exynos Modem 5123, Samsung Exynos Modem 5300, Samsung Exynos W920. Vendors: Samsung.

Quick answers

Is CVE-2023-37366 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-37366 being exploited in the wild.
How severe is CVE-2023-37366?
Low severity, with a CVSS score of 2.8, published 14 September 2026.
Which products and versions are affected?
Samsung Exynos 9610 all; Samsung Exynos 9810 all; Samsung Exynos 9820 all; Samsung Exynos Auto T5123 all; and 12 more.
Is there a fix for CVE-2023-37366?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-37366 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2023-37366?
Check whether you run Samsung Exynos 9610, Samsung Exynos 9810, Samsung Exynos 9820 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper handling of a loop with an unreachable exit condition in the Shannon SM Task component of Samsung Exynos processors. An attacker can send a specially crafted SM message that causes the task to enter an infinite loop, preventing graceful termination of the service. The attack requires the ability to send malformed messages to the SM Task, and successful exploitation results in a denial of service condition. Samsung has indicated patches are available, though availability varies by vendor implementation.

Affected products

  • Samsung Exynos 9810 all
  • Samsung Exynos 9610 all
  • Samsung Exynos 9820 all
  • Samsung Exynos 980 all
  • Samsung Exynos 850 all
  • Samsung Exynos 1080 all
  • Samsung Exynos 2100 all
  • Samsung Exynos 2200 all
  • Samsung Exynos 1280 all
  • Samsung Exynos 1380 all
  • Samsung Exynos 1330 all
  • Samsung Exynos 9110 all
  • Samsung Exynos W920 all
  • Samsung Exynos Modem 5123 all
  • Samsung Exynos Modem 5300 all
  • Samsung Exynos Auto T5123 all

Timeline

  • 2023-04-28: disclosed
  • 2026-09-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.