Input validation error in Samsung products - CVE-2025-49494
Published: November 3, 2025
Vulnerability identifier: #VU117920
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-49494
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect handling of 5G NRMM packet. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Affected software
Exynos 2100
Exynos 1280
Exynos 2200
Exynos 1330
Exynos 1380
Exynos 1480
Exynos 9110
Exynos Modem 5123
Exynos 1280
Exynos 2200
Exynos 1330
Exynos 1380
Exynos 1480
Exynos 9110
Exynos Modem 5123
How to mitigate CVE-2025-49494
Install updates from vendor's website.