EUVD-2026-85171
GHSA-h9m5-vm2j-qx22
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition rogue base station near target
-
DeliveryInduce victim modem to attach
-
ExploitSend malformed 3G RRC signalling message
-
ExecutionTrigger NULL pointer dereference in as_rrc
-
ImpactCrash modem firmware (loss of connectivity)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim device to use an ASR Crane/Falcon baseband running the vulnerable as_rrc module (3G/UMTS RRC stack, urrsir.c), and the attacker must deliver a crafted/malformed 3G RRC signalling message to that modem - realistically from radio proximity via a rogue base station or air-interface MITM rather than arbitrary internet access. Limiting factors: the target must be a 3G-capable ASR modem actively processing RRC signalling; the impact is confined to modem availability (crash/DoS) with no demonstrated code execution; and the vendor's AV:N is doubtful because the RRC attack surface is reached over the radio link, constraining attackers to physical/radio proximity. |
| Impact | This is a vendor-self-reported (ASR PSIRT) NULL pointer dereference in the ASR Crane/Falcon cellular baseband as_rrc module (3G/UMTS RRC signalling, file 3g.mod/lib/src/urrsir.c). The vendor CVSS 7.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) is internally inconsistent with a pure NULL-deref: a CWE-476 dereference realistically yields a crash/DoS (availability), so the C:L/I:L confidentiality and integrity impacts appear overstated - the true impact profile is availability-only. Two further metrics look questionable: AV:N is unusual for an over-the-air RRC parsing bug that requires radio proximity or a rogue base station (AV:A is more defensible), and PR:L is odd because an attacker feeding malformed RRC to a modem is not authenticated in the normal sense (PR:N is more accurate). There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so there is no evidence of active exploitation or automatable mass-exploitation - no public exploit identified at time of analysis. Net: despite the 7.4 label, real-world priority is moderate-to-low - it is a targeted, proximity-gated DoS against an embedded baseband, not a widespread remotely-weaponizable RCE. Key signals are missing (no EPSS/KEV/POC, no affected firmware versions) and the vendor vector conflicts with the description, which should be verified with ASR. |
| Exploit ScenarioDerived | An attacker within radio range operating a rogue/malicious base station (or an MITM on the air interface) coaxes a victim device using an ASR Crane/Falcon modem to attach, then transmits a malformed 3G/UMTS RRC signalling message that triggers pointer manipulation and a NULL dereference in the as_rrc module. The modem firmware crashes, dropping cellular connectivity (denial of service). No public exploit code is identified at time of analysis, and no active exploitation is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Malformed 3G/UMTS RRC signalling messages delivered to the ASR Crane/Falcon cellular baseband trigger a NULL pointer dereference in the as_rrc module (file 3g.mod/lib/src/urrsir.c), crashing the modem and denying cellular service to the affected device. ASR's self-assigned CVSS 3.1 score is 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), whereas independent assessment rates it AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a radio-proximity availability attack against 3G-capable ASR modem platforms, with no demonstrated code execution or data compromise. Exploitation requires the victim handset to be camped on or processing signalling from a hostile 3G cell (rogue base station or air-interface man-in-the-middle), and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV and the sole reference is the vendor PSIRT advisory.
RemediationAI
No vendor-released patch version is identified in the available data; the single reference, the ASR PSIRT advisory (https://www.asrmicro.com/en/goods/psirt?cid=45), is the authoritative place to check for a fixed baseband firmware build or an updated affected-product list, and because baseband firmware ships inside device/SoC images rather than as a standalone update, remediation will normally arrive as a device-vendor OTA or module firmware refresh - track that channel and plan a reboot/flash cycle since the fix cannot be applied by end users independently. Where patching is delayed, the most effective specific compensating control is to disable 3G/UMTS radio capability and force LTE/5G-only operation via the modem's preferred-network configuration or carrier policy, which removes the RRC parsing path entirely; the trade-off is loss of 3G coverage, circuit-switched fallback, and roaming in 3G-only regions. Additional controls that degrade but do not eliminate exposure: reject or down-prioritise untrusted/unknown PLMNs and disable automatic network selection to complicate rogue-base-station delivery (trade-off: manual network management and degraded roaming), and, in managed fleets, enable baseband isolation/virtualisation features where the SoC supports them to contain the crash impact. Because the assessed impact is a modem reset/hang (C:N/I:N/A:H) rather than code execution, treat this as a resilience problem - ensure watchdog/auto-recovery behaviour is enabled so a triggered fault self-heals into a temporary loss of service rather than a persistent outage, and monitor ASR PSIRT for a versioned fix before declaring closure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-476 NULL pointer dereference in the as_rrc module of ASR's Crane/Falcon baseband firmware, specifically in the source file 3g.mod/lib/src/urrsir.c. This file belongs to the UMTS/3G Radio Resource Control (RRC) layer implementation, the control-plane protocol that establishes and manages radio bearers, paging, and mobility between the user equipment and the network (NodeB/RNC). Because RRC messages are parsed from the air interface before any user-plane or application-layer authentication occurs, a malformed or unexpected RRC message can drive the parser into a code path where a pointer is dereferenced before being validated, causing a modem-level fault. The CPE cpe:2.3:a:asr:crane，falcon:*:*:*:*:*:*:*:* indicates that all tracked versions of the ASR Crane/Falcon baseband platform are in scope rather than a specific build. The impact class is availability only - the modem crashes or resets - which aligns with the independent assessment (C:N/I:N/A:H) and contrasts with the vendor's scope-changed C:L/I:L/A:L rating, whose 'network' vector (AV:N) and 'privileged' requirement (PR:L) are doubtful for an attack that materially arrives over the radio link and is triggered by network-originated signalling a UE cannot refuse to parse.
Know when Crane Falcon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Over-the-air RRC parsing implies radio proximity (AV:A) and no real authentication (PR:N); a NULL-deref is availability-only (C:N/I:N/A:H) with no cross-system scope change (S:U).
Primary rating from Vendor (ASR).
CVSS VectorVendor: ASR
DescriptionCVE.org
NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation.
This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c.
Executive ViewAI
Organizations deploying devices with ASR Crane/Falcon cellular basebands face a high-severity availability threat: malformed 3G signalling can crash the modem, severing cellular connectivity for the affected device. With no vendor patch available, these devices remain vulnerable to disruption from nearby hostile 3G cells, potentially impacting field operations, emergency communications, and any workflow dependent on continuous cellular service.
Disable 3G/UMTS on affected ASR Crane/Falcon devices (force LTE/5G only); monitor for unexpected modem crashes; avoid operation near untrusted 3G cells; contact ASR PSIRT for interim workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB