CVE-2024-46921: exynos 980 DoS — Fix

Description

An issue was discovered in Samsung Mobile Processor and Modem Exynos 9820, 9825, 980, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W1000, Modem 5123, Modem 5300, Modem 5400. UE does not limit the number of attempts for the RRC Setup procedure in the 5G SA, leading to a denial of service (battery-drain attack).

Is your site exposed to CVE-2024-46921?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-770 CWE-770

Affected Products

Vendor	Product	Versions
samsung	exynos_1080_firmware	All
samsung	exynos_1080	All
samsung	exynos_1280_firmware	All
samsung	exynos_1280	All
samsung	exynos_1330_firmware	All
samsung	exynos_1330	All
samsung	exynos_1380_firmware	All
samsung	exynos_1380	All
samsung	exynos_1480_firmware	All
samsung	exynos_1480	All
samsung	exynos_2100_firmware	All
samsung	exynos_2100	All
samsung	exynos_2200_firmware	All
samsung	exynos_2200	All
samsung	exynos_2400_firmware	All
samsung	exynos_2400	All
samsung	exynos_9110_firmware	All
samsung	exynos_9110	All
samsung	exynos_980_firmware	All
samsung	exynos_980	All
samsung	exynos_9820_firmware	All
samsung	exynos_9820	All
samsung	exynos_9825_firmware	All
samsung	exynos_9825	All
samsung	exynos_990_firmware	All
samsung	exynos_990	All
samsung	exynos_modem_5123_firmware	All
samsung	exynos_modem_5123	All
samsung	exynos_modem_5300_firmware	All
samsung	exynos_modem_5300	All
samsung	exynos_modem_5400_firmware	All
samsung	exynos_modem_5400	All
samsung	exynos_w1000_firmware	All
samsung	exynos_w1000	All

References

Advisories & Patches

https://semiconductor.samsung.com/support/quality-support/product-security-updates/ https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-46921/

Other References

https://github.com/asset-group/5ghoul-5g-nr-attacks/tree/master

Frequently Asked Questions

What is CVE-2024-46921? +

An issue was discovered in Samsung Mobile Processor and Modem Exynos 9820, 9825, 980, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W1000, Modem 5123, Modem 5300, Modem 5400. UE does not limit the number of attempts for the RRC Setup procedure in the 5G SA, leading to a denial of service (battery-drain attack). It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-46921? +

CVE-2024-46921 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-46921? +

CVE-2024-46921 affects products from samsung, specifically: exynos_1080, exynos_1080_firmware, exynos_1280, exynos_1280_firmware, exynos_1330, exynos_1330_firmware, exynos_1380, exynos_1380_firmware, exynos_1480, exynos_1480_firmware, exynos_2100, exynos_2100_firmware, exynos_2200, exynos_2200_firmware, exynos_2400, exynos_2400_firmware, exynos_9110, exynos_9110_firmware, exynos_980, exynos_980_firmware, exynos_9820, exynos_9820_firmware, exynos_9825, exynos_9825_firmware, exynos_990, exynos_990_firmware, exynos_modem_5123, exynos_modem_5123_firmware, exynos_modem_5300, exynos_modem_5300_firmware, exynos_modem_5400, exynos_modem_5400_firmware, exynos_w1000, exynos_w1000_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-46921? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-39313

mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in …

CVE-2026-35469

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser …

CVE-2026-39803

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. …

CVE-2026-39804

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion …

CVE-2026-32688

Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table …

CVE-2026-10573

A denial-of-service security issue exists in 1734 POINT I/O™ module. The security issue stems from improper handling of crafted CIP …

CVE-2024-46921