What is the CVSS score of CVE-2025-23102?

CVE-2025-23102 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Exynos 1080 Firmware are affected by CVE-2025-23102?

A critical privilege escalation vulnerability affects Samsung mobile processors used in enterprise devices, potentially allowing attackers to gain unauthorized administrative access.

How to fix or mitigate CVE-2025-23102?

Within 24 hours: Identify and inventory all Samsung devices using affected Exynos processors (980, 990, 1080, 2100, 1280, 2200, 1380, 1480, 2400). Within 7 days: Implement device usage restrictions, disable non-essential local execution capabilities, and escalate device security monitoring. Within 30 days: Monitor Samsung security advisories for patch availability, evaluate device replacement timelines for critical infrastructure, and assess feasibility of vendor firmware updates as they become available.

Exynos 1080 Firmware CVE-2025-23102

EUVD-2025-16776 HIGH

Double Free (CWE-415)

2025-06-03 cve@mitre.org

Privilege Escalation Memory Corruption Samsung Exynos 1080 Firmware Exynos 1280 Firmware Exynos 1380 Firmware Exynos 1480 Firmware Exynos 2100 Firmware Exynos 2200 Firmware Exynos 2400 Firmware Exynos 980 Firmware Exynos 990 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16776

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 19:15 nvd

HIGH 8.8

DescriptionCVE.org

An issue was discovered in Samsung Mobile Processor Exynos 980, 990, 1080, 2100, 1280, 2200, 1380, 1480 and 2400. A Double Free in the mobile processor leads to privilege escalation.

AnalysisAI

Double-free vulnerability in Samsung's Exynos mobile processors (models 980, 990, 1080, 2100, 1280, 2200, 1380, 1480, and 2400) that enables privilege escalation. An authenticated attacker with local access can trigger the memory corruption flaw to gain elevated privileges on affected devices. With a CVSS score of 8.8 and network accessibility (AV:N), this represents a critical risk for Samsung mobile device users, particularly if the vulnerability is actively exploited in-the-wild.

Technical ContextAI

The vulnerability exists within Samsung's proprietary Exynos mobile processor microarchitecture, likely in kernel-level or secure enclave memory management routines. CWE-415 (Double Free) occurs when a program attempts to free memory that has already been freed, leading to heap corruption. In the context of mobile processors with memory protection extensions (ARM TrustZone, Samsung Knox), a double-free in privileged processor code could allow an attacker to overwrite critical kernel data structures or security policy enforcement mechanisms. The affected Exynos processors span multiple generations (980/990 from Exynos 9-series, 1080/1280/1380/1480 from mid-range lines, and flagship 2100/2200/2400 models), suggesting the vulnerability is systemic across Samsung's processor design lineups rather than isolated to a single architecture version. CPE strings would typically match: cpe:2.3:h:samsung:exynos_980:*:*:*:*:*:*:*:* through cpe:2.3:h:samsung:exynos_2400:*:*:*:*:*:*:*:*

RemediationAI

Patch availability and specific patch versions were not provided in source data; remediation depends on Samsung's processor update cadence. Recommended actions: (1) Monitor Samsung Security Updates page and device manufacturer security bulletins for microcode patches or bootloader updates addressing CVE-2025-23102; (2) Apply all available security patches and OS updates immediately upon release, as these will contain mitigations; (3) For enterprise deployments, implement Mobile Device Management (MDM) policies to enforce automatic patching and isolate affected devices from sensitive networks; (4) As a temporary mitigation, restrict local access to unprivileged user accounts and disable unnecessary local services that could be chained with this vulnerability; (5) Coordinate with carriers to ensure timely distribution of patches, as processor-level fixes require OEM and carrier collaboration. Hardware workarounds do not exist; vulnerability remediation requires security patch deployment.