Exynos 1080 Firmware CVE-2025-57835

Real-world risk is moderate despite high CVSS severity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is remotely exploitable with low complexity and no authentication - theoretically a rogue base station or malicious network peer could deliver crafted RRCReconfiguration messages. However, multiple mitigating factors reduce practical risk: (1) EPSS score of 0.02% places this in the 5th percentile, indicating security researchers assess exploitation probability as very low in the next 30 days; (2) no public exploit identified at time of analysis and not listed in CISA KEV; (3) exploitation requires cellular network proximity or control of network infrastructure (femtocell, compromised base station, IMSI catcher) to inject malicious RRC signaling; (4) impact is strictly availability (A:H) with no confidentiality or integrity compromise - attackers achieve only device crash/reboot, not remote code execution or data exfiltration. The lack of POC code and low EPSS suggests this is primarily a vendor-identified quality/stability issue rather than an actively targeted attack vector. Organizations should prioritize patching for critical infrastructure devices (emergency services, IoT/M2M deployments) where service availability is paramount, but consumer device patching can follow normal maintenance cycles unless threat intelligence indicates targeting of Samsung baseband vulnerabilities.

An attacker operating a rogue LTE/5G base station (using software-defined radio equipment or compromised femtocell) within range of target Samsung devices broadcasts a specially crafted RRCReconfiguration message with malformed parameters that trigger the uninitialized memory access condition. Victim devices performing normal cell reselection or handover procedures receive and process the malicious RRC message, causing the Exynos baseband processor to crash and forcing an immediate modem restart or full device reboot. This could be weaponized for localized denial-of-service attacks against specific individuals (surveillance targets, VIPs at events) or mass disruption at high-density locations (airports, stadiums, protests) where an attacker-controlled base station can capture device connections. The attack requires no user interaction and works against idle devices, though practical deployment requires radio equipment and cellular network knowledge.