Samsung Exynos Modem CVE-2026-33970

The victim device must use one of the 16 affected Exynos SoC or modem variants and be operating on a 5G NR network (NR RRC path, not 4G LTE). The attacker must be able to deliver a malformed RRC Reconfiguration message to the target device, which in practice requires operating a rogue 5G base station (gNB) or compromising a legitimate network element within range of the target - a significant technical and physical prerequisite. The device must connect to the attacker-controlled cell, which typically requires the rogue signal to be stronger than the legitimate serving cell (RSRP-based cell selection). No special app, user interaction, or device configuration is required once the device camps on the malicious cell. Exploitation is limited by: (1) physical proximity requirement for radio range, (2) significant technical capability to stand up a 5G NR gNB, (3) availability impact only - no data exfiltration or code execution consequence, and (4) high attack complexity as reflected in AC:H.

The vendor-assigned CVSS 3.1 score of 3.5 (Low) accurately reflects the constrained real-world impact. The attack vector is Network (AV:N, representing the air interface), but High Complexity (AC:H) gates exploitation behind a significant capability requirement: the attacker must control or simulate a 5G gNB to deliver a crafted RRC Reconfiguration message - well beyond the means of opportunistic or remote internet attackers. The impact ceiling is Availability:Low with no confidentiality or integrity consequence, meaning the worst realistic outcome is a transient loss of cellular connectivity or modem reset. No public exploit code exists and no EPSS score is available in the provided data, but the operational barrier (rogue base station setup, proximity to target) keeps realistic risk low regardless. Even a network security team in gdynia managing a large Samsung device fleet should treat this primarily as a carrier/infrastructure concern rather than a direct end-user threat, applying Samsung's security update when it becomes available through normal patch cadence. The CVSS S:C (Changed Scope) is technically defensible - modem crashes affect host connectivity - but should not inflate perceived severity given the A:L outcome ceiling.

An attacker deploys a software-defined radio (SDR) configured as a rogue 5G gNB in proximity to a target Samsung device. When the target device camps on the rogue cell, the attacker transmits a specially crafted RRC Reconfiguration message with a malformed field that triggers a NULL pointer dereference in the Exynos modem firmware, causing the baseband to crash and the device to lose cellular connectivity until the modem resets. No public exploit code exists for this vulnerability at time of analysis.