Crane Falcon
Monthly
Malformed 3G/UMTS RRC signalling messages delivered to the ASR Crane/Falcon cellular baseband trigger a NULL pointer dereference in the as_rrc module (file 3g.mod/lib/src/urrsir.c), crashing the modem and denying cellular service to the affected device. ASR's self-assigned CVSS 3.1 score is 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), whereas independent assessment rates it AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a radio-proximity availability attack against 3G-capable ASR modem platforms, with no demonstrated code execution or data compromise. Exploitation requires the victim handset to be camped on or processing signalling from a hostile 3G cell (rogue base station or air-interface man-in-the-middle), and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV and the sole reference is the vendor PSIRT advisory.
Malformed 3G/UMTS RRC signalling messages delivered to the ASR Crane/Falcon cellular baseband trigger a NULL pointer dereference in the as_rrc module (file 3g.mod/lib/src/urrsir.c), crashing the modem and denying cellular service to the affected device. ASR's self-assigned CVSS 3.1 score is 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), whereas independent assessment rates it AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a radio-proximity availability attack against 3G-capable ASR modem platforms, with no demonstrated code execution or data compromise. Exploitation requires the victim handset to be camped on or processing signalling from a hostile 3G cell (rogue base station or air-interface man-in-the-middle), and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV and the sole reference is the vendor PSIRT advisory.