Executive brief
A vulnerability exists in several Samsung Exynos processors and modems used in smartphones and wearable devices. An attacker could exploit this flaw to cause a denial-of-service, effectively crashing the device or its cellular connectivity. This could disrupt emergency communications, business operations, and general device availability for affected users.
Technical details
A vulnerability classified as improper input validation (CWE-20) exists in the firmware of multiple Samsung Exynos chipsets and modems. The flaw allows a remote, unauthenticated attacker to send specially crafted input over the network to trigger a denial-of-service (DoS) condition. Affected components include a wide range of mobile and wearable processors (e.g., Exynos 2100, 2400, W1000) and discrete modems (e.g., Modem 5300, 5400). While the specific protocol or message type is not detailed in the primary advisory, the impact is a high-availability disruption. Users should apply firmware updates provided by their device manufacturers.
Affected products
- Samsung Exynos 980
- Samsung Exynos 850
- Samsung Exynos 990
- Samsung Exynos 1080
- Samsung Exynos 2100
- Samsung Exynos 1280
- Samsung Exynos 2200
- Samsung Exynos 1330
- Samsung Exynos 1380
- Samsung Exynos 1480
- Samsung Exynos 2400
- Samsung Exynos 1580
- Samsung Exynos 2500
- Samsung Exynos 1680
- Samsung Exynos 9110
- Samsung Exynos W920
- Samsung Exynos W930
- Samsung Exynos W1000
- Samsung Modem 5123
- Samsung Modem 5300
- Samsung Modem 5400
- Samsung Modem 5410
Timeline
- 2026-04-06: advisory