PT-2025-21235 · Samsung · Exynos

Ali Ranjbar + 3 · Publicado 2025-05-14 · Atualizado 2025-05-14 · CVE-2025-27891

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400

Description: The issue is related to the lack of a length check, which leads to out-of-bounds reads via malformed NAS packets.

Recommendations: For Samsung Mobile Processor, Wearable Processor, and Modem Exynos versions 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400, consider implementing a length check to prevent out-of-bounds reads. As a temporary workaround, consider restricting the processing of NAS packets to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2025-27891

Produtos afetados

Exynos

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-27891 · Nota de Segurança
• https://semiconductor.samsung.com/support/quality-support/product-security-updates · Aviso do Fabricante
• https://t.me/cvetracker/23864 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1922765624679510405 · Publicação no Twitter
• https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-27891 · Aviso do Fabricante