Description

An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, Modem 5400, and Modem 5410. Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-09-14T02:17:13.807Z",
  "pubdate": "2026-09-14T02:17:13.807Z",
  "executiveSummary": "A critical vulnerability exists within the NR RRC (New Radio Radio Resource Control) stack of various Samsung Exynos processors and modems.\nThe flaw stems from the incorrect handling of unauthenticated downlink RRC Setup messages, leading to a baseband service denial-of-service (DoS) condition.\nAffected products include Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, and Modems 5300, 5400, and 5410.\nThe vulnerability allows an unauthenticated remote attacker to cause a baseband crash, effectively disconnecting the device from cellular networks.\nExploitation requires the attacker to be within radio range to transmit malicious downlink RRC signals.\nRisk implications include persistent loss of connectivity and potential system instability, as the baseband processor becomes unresponsive, requiring a reset or power cycle to restore functionality.",
  "technicalDetails": "The vulnerability resides within the NR RRC (Radio Resource Control) protocol stack implementation on the Samsung baseband firmware. The RRC layer is responsible for the control plane signaling between the User Equipment (UE) and the Radio Access Network (RAN).\nThe root cause is an improper validation and handling logic for incoming downlink RRC Setup messages. Specifically, the baseband fails to adequately sanitize or verify the structure and contents of these messages when they arrive in an unauthenticated state during the initial connection setup phase.\nIn the 5G NR (New Radio) connection establishment procedure, the UE receives an RRCSetup message from the gNodeB (gNB) to transition from RRC_IDLE or RRC_INACTIVE to RRC_CONNECTED mode. Because this message occurs prior to the establishment of a secure context (AS security), the baseband must process these signals with strictly validated inputs.\nAn attacker simulating a malicious gNB or performing a Man-in-the-Middle (MitM) attack can inject a malformed or crafted RRC Setup message. When the Exynos baseband receives this malformed packet, the internal parser encounters an unexpected condition, such as a pointer dereference error, buffer overflow, or an out-of-bounds memory access during the decoding of the RRC information elements.\nAttack flow: 1. The attacker positions a malicious radio signal transmitter within the broadcast range of the target UE. 2. The attacker triggers the UE to initiate an RRC connection attempt or intercepts a legitimate connection attempt. 3. The attacker intercepts or preempts the legitimate gNB response by sending a specially crafted, malicious RRC Setup message. 4. The target UE's baseband firmware processes the malicious message. 5. Due to the lack of sufficient state validation, the firmware execution flow is disrupted, resulting in a kernel panic or an unrecoverable exception within the baseband RTOS (Real-Time Operating System).\nPost-exploitation impact manifests as a complete cessation of baseband services. This includes loss of network registration, inability to perform emergency calls, and total failure of mobile data services. Given that the baseband is a privileged subsystem in modern mobile architectures, such crashes often necessitate a full modem reset, which can be disruptive to the user experience and potentially lead to intermittent or permanent connectivity loss depending on the system's watchdog and recovery implementation."
}