CVE-2026-23792 Overview
CVE-2026-23792 affects the New Radio Radio Resource Control (NR RRC) implementation in multiple Samsung Exynos mobile processors and standalone modem chipsets. The baseband improperly handles unauthenticated downlink RRC Setup messages, allowing a network-adjacent attacker to crash the modem. The flaw is categorized under [CWE-346] Origin Validation Error, since the baseband processes control-plane messages without confirming they originate from a legitimate base station.
Critical Impact
A rogue base station within radio range can transmit crafted RRC Setup frames that crash the Exynos baseband, disrupting cellular connectivity on affected Samsung mobile devices and 5G modems.
Affected Products
- Samsung Exynos Mobile Processors: 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500
- Samsung Exynos W1000 wearable processor
- Samsung Exynos Modem 5300, 5400, and 5410
Discovery Timeline
- 2026-09-14 - CVE-2026-23792 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-23792
Vulnerability Analysis
The vulnerability resides in the NR RRC protocol handler implemented in the Samsung Exynos baseband firmware. RRC is the 5G control-plane protocol governing connection establishment, mobility, and configuration between user equipment and the gNodeB. The baseband accepts and parses downlink RRCSetup messages before validating that the sender is an authenticated network. Malformed or unexpected fields in the message trigger an unrecoverable fault in the modem firmware, resulting in a crash.
Because RRC Setup occurs early in the connection procedure — before Authentication and Key Agreement (AKA) — the message path is inherently unauthenticated. Any transmitter capable of impersonating a gNodeB on the correct frequency can deliver the malicious frame.
Root Cause
The root cause is insufficient origin validation and input sanitization on pre-authentication RRC signaling [CWE-346]. The baseband trusts the structure and contents of downlink RRC Setup Protocol Data Units (PDUs) without verifying that the originating cell corresponds to a valid, subscribed network. Malformed information elements propagate into internal state handling and cause the modem processor to fault.
Attack Vector
Exploitation requires the attacker to operate a rogue gNodeB or software-defined radio within radio proximity of the target device. The attacker broadcasts a stronger signal than the legitimate network, causing the victim device to initiate an RRC connection. During the setup exchange, the rogue base station sends a crafted RRCSetup message that the Exynos baseband cannot process safely. The modem crashes, terminating cellular data and voice service until it recovers or the device is reset. The attack complexity is high because it requires RF proximity, precise timing, and specialized transmission equipment.
No verified proof-of-concept code has been published for this vulnerability. Refer to the Samsung CVE-2026-23792 Advisory for vendor technical details.
Detection Methods for CVE-2026-23792
Indicators of Compromise
- Repeated, unexplained baseband or modem crashes logged in device diagnostic logs (ramdump, modem_log, or vendor equivalents).
- Unexpected loss of cellular service in a specific physical location, especially in environments where rogue base stations are plausible.
- Device logs showing RRC connection attempts to cells with unusual Physical Cell Identifiers (PCIs), Public Land Mobile Network (PLMN) identifiers, or Tracking Area Codes that do not match the carrier's deployment.
Detection Strategies
- Monitor mobile fleet telemetry for anomalous modem reset events correlated across devices in the same location.
- Deploy IMSI-catcher and rogue base station detection tooling in sensitive facilities to identify unauthorized 5G transmitters.
- Correlate carrier-provided signaling data with endpoint mobile device management (MDM) reports to surface repeated RRC failures.
Monitoring Recommendations
- Ingest MDM and endpoint mobile logs into a central SIEM and alert on clusters of baseband crashes across managed devices.
- Track Samsung firmware and baseband build versions across the fleet to confirm patch adoption after Samsung updates ship.
- Establish a baseline of expected cellular network identifiers and alert when devices attach to unrecognized cells.
How to Mitigate CVE-2026-23792
Immediate Actions Required
- Inventory all Samsung devices containing the affected Exynos processors and modems listed in the advisory.
- Apply Samsung firmware updates as soon as they are distributed by the device manufacturer or carrier.
- Instruct high-risk users to disable 5G Standalone (SA) mode where feasible, or enable airplane mode in untrusted RF environments.
Patch Information
Samsung addresses baseband vulnerabilities through firmware updates delivered by device OEMs and mobile carriers. Refer to the Samsung Product Security Updates portal and the Samsung CVE-2026-23792 Advisory for chipset-specific patch availability and integration guidance for downstream OEMs.
Workarounds
- Restrict device use in physical locations with credible rogue base station risk until patched firmware is installed.
- Prefer Wi-Fi connectivity with a trusted VPN in high-risk environments to reduce exposure to malicious cellular signaling.
- Enforce MDM policies that require the latest OEM firmware baseline before granting access to corporate resources.
# Example: query Android baseband version to verify patch level
adb shell getprop gsm.version.baseband
adb shell getprop ro.build.version.security_patch
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
