Exynos 1080 Firmware EUVD-2025-209239

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates network-accessible attack with low complexity requiring no privileges or user interaction, resulting in high availability impact only. However, real-world risk is significantly moderated by attack prerequisites: the attacker must either control cellular network infrastructure (cell tower/core network) to inject malicious proactive commands, deploy a rogue base station, or physically compromise the SIM card itself. The EPSS score of 0.02% (5th percentile) aligns with this assessment, indicating security researchers assess exploitation probability as very low. No public exploit identified at time of analysis and absence from CISA KEV confirms no active exploitation campaigns. While SSVC technical impact is HIGH (total device DoS), exploitation status is NONE and automatable capability is LIMITED due to infrastructure requirements. This represents a moderate-priority issue for organizations with high-value targets facing nation-state or sophisticated adversaries who could deploy rogue base stations, but low priority for typical enterprise environments. The broad chipset scope is concerning, but remediation depends entirely on Samsung semiconductor firmware updates propagating through OEM device manufacturers.

An attacker deploys a rogue base station (IMSI catcher/Stingray device) in proximity to target devices containing vulnerable Exynos chipsets, forcing victim devices to connect to the malicious cellular infrastructure. The attacker then injects specially crafted USIM proactive commands through the cellular control channel that trigger uncontrolled resource consumption in the baseband processor. The malformed commands cause the modem firmware to enter an error state, resulting in complete loss of cellular connectivity or full device crash requiring reboot. Alternatively, an advanced persistent threat actor with supply chain access could pre-program malicious SIM cards distributed to targets, causing denial of service when inserted into vulnerable devices. The low attack complexity (AC:L) reflects the straightforward nature of command injection once network position is achieved, though the infrastructure prerequisites make mass exploitation impractical.