CVE-2025-66366
Received Received - Intake

Incorrect Handling of Unauthenticated Downlink RRC Setup Causes Baseband Crash

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: a8bfbd5c-5645-475e-a8f4-6c140c17bd29

Description
Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2025-66366
EUVD
EUVD-2025-211265

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect handling of unauthenticated downlink RRC Setup messages in certain Samsung Exynos chipsets. This flaw can cause the baseband processor to crash, potentially disrupting cellular connectivity and device functionality.

Detection Guidance

Detection requires monitoring for baseband crashes or abnormal RRC message handling. Check system logs for baseband processor errors or unexpected reboots. Network monitoring tools may detect unusual downlink RRC Setup message patterns targeting Samsung Exynos modems.

Impact Analysis

If exploited, this vulnerability could lead to denial-of-service conditions, causing your device to lose cellular network access. This may result in dropped calls, failed data connections, or inability to connect to emergency services.

Compliance Impact

The vulnerability involves incorrect handling of unauthenticated downlink RRC Setup messages causing baseband crashes. This could potentially lead to denial-of-service conditions in mobile devices, but there is no direct evidence linking it to compliance impacts on standards like GDPR or HIPAA.

Mitigation Strategies

Apply firmware updates from Samsung for affected Exynos modems. Disable unnecessary RRC message processing or restrict unauthenticated downlink messages. Monitor baseband stability and isolate affected devices if crashes occur.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...