PT-2024-22249 · Samsung · Exynos W920+6

Dyon Goos + 1 · Published 2024-07-09 · Updated 2025-06-26 · CVE-2024-28068

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Samsung Mobile Processor, Wearable Processor, and Modems versions Exynos 9820 through Exynos 2400 Samsung Mobile Processor, Wearable Processor, and Modems versions Exynos 9110, Exynos W920, Exynos W930 Samsung Mobile Processor, Wearable Processor, and Modems versions Exynos Modem 5123, Exynos Modem 5300

Description A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems that involves a NULL pointer dereference. This can cause abnormal termination of a mobile phone via a manipulated packet.

Recommendations For versions Exynos 9820 through Exynos 2400, update to a version that includes a fix for the NULL pointer dereference issue. For versions Exynos 9110, Exynos W920, Exynos W930, update to a version that includes a fix for the NULL pointer dereference issue. For versions Exynos Modem 5123, Exynos Modem 5300, update to a version that includes a fix for the NULL pointer dereference issue. As a temporary workaround, consider restricting the reception of manipulated packets to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2024-28068

Affected Products

Exynos 2400

Exynos 9110

Exynos 9820

Exynos Modem 5123

Exynos Modem 5300

Exynos W920

Exynos W930

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-28068 · Security Note
• https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-28068 · Vendor Advisory
• https://semiconductor.samsung.com/support/quality-support/product-security-updates · Vendor Advisory
• https://t.me/cvedetector/450 · Telegram Post
• https://t.me/cvenotify/126805 · Telegram Post
• https://twitter.com/CVEnew/status/1811322736482132402 · Twitter Post