What is the CVSS score of CVE-2025-66369?

CVE-2025-66369 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Samsung Exynos are affected by CVE-2025-66369?

CVE-2025-66369 is a high-severity denial of service vulnerability affecting Samsung Exynos chipsets used in millions of mobile devices and network infrastructure worldwide.

How to fix or mitigate CVE-2025-66369?

Within 24 hours: Inventory all Samsung Galaxy devices (flagged models: S20/S21/S22/S23/S24 series, Note series, A-series, Fold/Flip, tablets) and 5G infrastructure components using identified Exynos chipsets (980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000, modems 5123, 5300, 5400). Within 7 days: Contact Samsung support for security bulletin and patch timeline confirmation; enable network monitoring for anomalous 5G NAS traffic patterns. Within 30 days: Apply vendor-released patches immediately upon availability; consider disabling 5G connectivity on non-critical devices as interim mitigation if patch delay extends beyond 30 days.

Samsung Exynos CVE-2025-66369

EUVD-2025-209645 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-05 mitre

GHSA-386p-v9x3-gxpm

Denial Of Service Samsung N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 20:30 vuln.today

CVSS changed

May 06, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

May 05, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

An issue was discovered in MM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Incorrect handling of 5G NR NAS registration accept messages leads to a Denial of Service.

AnalysisAI

Denial of Service vulnerability in Samsung Exynos chipsets (980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000, and modems 5123, 5300, 5400) allows remote unauthenticated attackers to crash devices by sending malformed 5G NR NAS registration accept messages. The flaw affects the Mobility Management (MM) component's message parser, triggering resource exhaustion (CWE-770) that disrupts cellular connectivity. CVSS 7.5 (High) with network attack vector and no prerequisites, though EPSS indicates only 0.02% exploitation probability and no public exploits identified at time of analysis.

Technical ContextAI

This vulnerability resides in the Mobility Management (MM) layer of Samsung's Exynos baseband processors, which handles 5G Non-Standalone (NR) Network Attached Subsystem (NAS) protocol messages during device registration with cellular networks. NAS registration accept messages are sent by the 5G core network to confirm successful device attachment. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), indicating the MM component fails to properly validate or constrain resource consumption when processing malformed registration messages. This affects both Application Processors (Exynos 980/990/850/2100/1280/2200/1330/1380/1480/2400/1580/2500) and dedicated modem chipsets (Modem 5123/5300/5400), plus wearable processors (W920/W930/W1000). The vulnerability sits at the intersection of cellular protocol implementation and low-level firmware, making it accessible via the radio interface without requiring physical access or user interaction.

RemediationAI

Apply firmware updates from Samsung Semiconductor as documented in the official security bulletin at https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-66369/. For end users, updates are typically delivered through device manufacturer OTA updates-check with Samsung Mobile or device OEM for availability. Specific patched firmware versions are not disclosed in public advisories. Compensating controls for high-risk environments: temporarily disable 5G connectivity and force devices to 4G/LTE mode through network settings (Settings > Connections > Mobile Networks > Network Mode > LTE/3G/2G), which eliminates exposure to 5G NR NAS message parsing but reduces network performance and disables 5G features. In enterprise deployments, implement network-based monitoring for unusual cellular disconnection patterns that might indicate exploitation attempts. No firewall or network segmentation mitigations apply as the vulnerability exists in cellular baseband firmware accessible only via radio interface.