EUVD-2025-209266
GHSA-326f-rc6r-57wf
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Incorrect Handling of the NL80211 vendor command leads to a buffer overflow via a certain ioctl message, issue 1 of 2.
Analysis
Buffer overflow in Samsung Exynos Wi-Fi driver (980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, W1000) allows unauthenticated remote code execution via malformed NL80211 vendor command ioctl message. Incorrect handling of vendor-specific wireless configuration commands enables network-based memory corruption. CVSS 9.8 critical severity reflects network attack vector requiring no authentication or user interaction. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.01%).
Technical Context
Root cause is CWE-120 buffer overflow in Exynos chipset Wi-Fi driver's NL80211 vendor command parser. Improper bounds checking when processing ioctl messages to nl80211 vendor-specific interface allows attacker-controlled data to overflow allocated buffer. Network Layer 80211 (nl80211) cfg80211 kernel interface mishandles vendor command extension parsing, enabling memory corruption through crafted wireless management frames.
Affected Products
Samsung Mobile Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580. Samsung Wearable Processor Exynos W920, W930, W1000. All versions of affected chipsets prior to security update. No CPE enumeration available.
Remediation
Vendor-released patch: Apply Samsung Semiconductor security updates per advisory at https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-52908/. Device manufacturers using affected Exynos chipsets must integrate firmware updates into Android/Tizen security patches and push OTA updates to end-user devices. Check device manufacturer security bulletins for model-specific patch availability timelines. No workaround exists for kernel-level driver vulnerability; disable Wi-Fi on affected devices until patched if exposure to untrusted networks is unavoidable. Monitor Samsung's product security portal for chipset-specific firmware versions and integration guidance for OEMs.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today