What is the CVSS score of CVE-2025-52908?

CVE-2025-52908 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Samsung are affected by CVE-2025-52908?

CVE-2025-52908 is a critical remote code execution vulnerability in Samsung Exynos Wi-Fi drivers (affecting models 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, W1000) that allows…

How to fix or mitigate CVE-2025-52908?

Within 24 hours: inventory all Samsung devices using affected Exynos Wi-Fi drivers (980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, W1000) and isolate critical systems from untrusted networks. Within 7 days: contact Samsung for security guidance and interim firmware status; implement network segmentation to restrict direct Wi-Fi access to sensitive assets; monitor for suspicious wireless traffic patterns. Within 30 days: apply vendor-released patch immediately upon availability; confirm deployment across all affected devices; conduct forensic review of device access logs for indicators of exploitation.

Samsung CVE-2025-52908

EUVD-2025-209266 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-04-07 mitre

GHSA-326f-rc6r-57wf

Buffer Overflow Samsung

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 15:30 euvd

EUVD-2025-209266

Analysis Generated

Apr 07, 2026 - 15:30 vuln.today

CVE Published

Apr 07, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Incorrect Handling of the NL80211 vendor command leads to a buffer overflow via a certain ioctl message, issue 1 of 2.

AnalysisAI

Buffer overflow in Samsung Exynos Wi-Fi driver (980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, W1000) allows unauthenticated remote code execution via malformed NL80211 vendor command ioctl message. Incorrect handling of vendor-specific wireless configuration commands enables network-based memory corruption. CVSS 9.8 critical severity reflects network attack vector requiring no authentication or user interaction. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.01%).

Technical ContextAI

Root cause is CWE-120 buffer overflow in Exynos chipset Wi-Fi driver's NL80211 vendor command parser. Improper bounds checking when processing ioctl messages to nl80211 vendor-specific interface allows attacker-controlled data to overflow allocated buffer. Network Layer 80211 (nl80211) cfg80211 kernel interface mishandles vendor command extension parsing, enabling memory corruption through crafted wireless management frames.

RemediationAI

Vendor-released patch: Apply Samsung Semiconductor security updates per advisory at https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-52908/. Device manufacturers using affected Exynos chipsets must integrate firmware updates into Android/Tizen security patches and push OTA updates to end-user devices. Check device manufacturer security bulletins for model-specific patch availability timelines. No workaround exists for kernel-level driver vulnerability; disable Wi-Fi on affected devices until patched if exposure to untrusted networks is unavoidable. Monitor Samsung's product security portal for chipset-specific firmware versions and integration guidance for OEMs.