# CVE-2025-54324: Samsung Exynos Modem denial of service in NAS layer

Source: https://junglewise.ai/threats/cve-2025-54324-samsung-exynos-modem-denial-of-service-in-nas-layer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2025-54324 · Severity: high · CVSS 7.5 · Published 2026-04-06

A vulnerability has been identified in the modem and processor components of various Samsung mobile and wearable devices. These components handle cellular network communications. An attacker could exploit this flaw to cause the device's modem to crash or stop responding, resulting in a loss of cellular connectivity and a disruption of mobile services.

## Quick answers

**Is CVE-2025-54324 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-54324 being exploited in the wild.

**How severe is CVE-2025-54324?** High severity, with a CVSS score of 7.5, published 6 April 2026.

**Which products and versions are affected?** Samsung Exynos 980; Samsung Exynos 990; Samsung Exynos 850; Samsung Exynos 1080; and 16 more.

**Is there a fix for CVE-2025-54324?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-54324 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2025-54324?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Non-Access Stratum (NAS) layer of several Samsung Exynos mobile processors, wearable processors, and standalone modems. The issue stems from the incorrect handling of Downlink (DL) NAS Transport packets. A remote attacker can exploit this by sending specially crafted packets over the network, leading to uncontrolled resource consumption (CWE-400) and a subsequent Denial of Service (DoS) of the modem component. The vulnerability affects a wide range of chipsets including the Exynos 980 through 2500 series, wearable chips like the W1000, and 5G modems like the 5400. No user interaction or authentication is required for exploitation.

## Affected products

- Samsung Exynos 980
- Samsung Exynos 990
- Samsung Exynos 850
- Samsung Exynos 1080
- Samsung Exynos 2100
- Samsung Exynos 1280
- Samsung Exynos 2200
- Samsung Exynos 1330
- Samsung Exynos 1380
- Samsung Exynos 1480
- Samsung Exynos 2400
- Samsung Exynos 1580
- Samsung Exynos 2500
- Samsung Exynos 9110
- Samsung Exynos W920
- Samsung Exynos W930
- Samsung Exynos W1000
- Samsung Exynos Modem 5123
- Samsung Exynos Modem 5300
- Samsung Exynos Modem 5400

## Timeline

- 2025-06-05: disclosed: Reported date according to vendor advisory
- 2026-04-06: advisory: Initial NVD publication date

## References

- [https://semiconductor.samsung.com/support/quality-support/product-security-updates/](https://semiconductor.samsung.com/support/quality-support/product-security-updates/)
- [https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54324/](https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54324/)