Sign-up

ID

VAR-202202-1806


CVE

CVE-2022-23425


TITLE

Android  Input verification vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-005407

DESCRIPTION

Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with fake base station. Android There is an input validation vulnerability in.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Exynos is a SoC developed and produced by Samsung Mobile and a processor based on Arm architecture for Samsung mobile devices. Baseband is a circuit in a mobile phone that is responsible for demodulating, descrambling, despreading and decoding wireless signals in mobile networks, and passing the final decoded digital signal to the upper-layer processing system for processing

Trust: 2.25

sources: NVD: CVE-2022-23425 // JVNDB: JVNDB-2022-005407 // CNVD: CNVD-2024-09551 // VULMON: CVE-2022-23425

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-09551

AFFECTED PRODUCTS

vendor:samsungmodel:mobile devices qscope: - version: -

Trust: 1.2

vendor:samsungmodel:mobile devices sscope: - version: -

Trust: 1.2

vendor:googlemodel:androidscope:eqversion:12.0

Trust: 1.0

vendor:googlemodel:androidscope:eqversion:10.0

Trust: 1.0

vendor:googlemodel:androidscope:eqversion:11.0

Trust: 1.0

vendor:googlemodel:androidscope:eqversion: -

Trust: 0.8

vendor:googlemodel:androidscope: - version: -

Trust: 0.8

vendor:samsungmodel:mobile devices rscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2024-09551 // JVNDB: JVNDB-2022-005407 // NVD: CVE-2022-23425

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-23425
value: CRITICAL

Trust: 1.0

mobile.security@samsung.com: CVE-2022-23425
value: HIGH

Trust: 1.0

NVD: CVE-2022-23425
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2024-09551
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202202-1064
value: CRITICAL

Trust: 0.6

VULMON: CVE-2022-23425
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-23425
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2024-09551
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-23425
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

mobile.security@samsung.com: CVE-2022-23425
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 4.7
version: 3.1

Trust: 1.0

NVD: CVE-2022-23425
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-09551 // VULMON: CVE-2022-23425 // JVNDB: JVNDB-2022-005407 // CNNVD: CNNVD-202202-1064 // NVD: CVE-2022-23425 // NVD: CVE-2022-23425

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.0

problemtype:Inappropriate input confirmation (CWE-20) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-005407 // NVD: CVE-2022-23425

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202202-1064

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202202-1064

PATCH

title:Top Pageurl:https://www.android.com/

Trust: 0.8

title:Patch for Samsung Exynos baseband input validation error vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/526571

Trust: 0.6

title:Samsung Exynos Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=183879

Trust: 0.6

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-23305

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-RCE

Trust: 0.1

sources: CNVD: CNVD-2024-09551 // VULMON: CVE-2022-23425 // JVNDB: JVNDB-2022-005407 // CNNVD: CNNVD-202202-1064

EXTERNAL IDS

db:NVDid:CVE-2022-23425

Trust: 3.9

db:JVNDBid:JVNDB-2022-005407

Trust: 0.8

db:CNVDid:CNVD-2024-09551

Trust: 0.6

db:CNNVDid:CNNVD-202202-1064

Trust: 0.6

db:VULMONid:CVE-2022-23425

Trust: 0.1

sources: CNVD: CNVD-2024-09551 // VULMON: CVE-2022-23425 // JVNDB: JVNDB-2022-005407 // CNNVD: CNNVD-202202-1064 // NVD: CVE-2022-23425

REFERENCES

url:https://security.samsungmobile.com/securityupdate.smsb?year=2022&month=2

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-23425

Trust: 2.0

url:https://cwe.mitre.org/data/definitions/20.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/alphabugx/cve-2022-23305

Trust: 0.1

sources: CNVD: CNVD-2024-09551 // VULMON: CVE-2022-23425 // JVNDB: JVNDB-2022-005407 // CNNVD: CNNVD-202202-1064 // NVD: CVE-2022-23425

SOURCES

db:CNVDid:CNVD-2024-09551
db:VULMONid:CVE-2022-23425
db:JVNDBid:JVNDB-2022-005407
db:CNNVDid:CNNVD-202202-1064
db:NVDid:CVE-2022-23425

LAST UPDATE DATE

2024-08-14T13:42:58.171000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-09551date:2024-02-21T00:00:00
db:VULMONid:CVE-2022-23425date:2022-02-18T00:00:00
db:JVNDBid:JVNDB-2022-005407date:2023-05-30T07:11:00
db:CNNVDid:CNNVD-202202-1064date:2022-03-10T00:00:00
db:NVDid:CVE-2022-23425date:2022-02-18T20:57:42.607

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-09551date:2022-10-12T00:00:00
db:VULMONid:CVE-2022-23425date:2022-02-11T00:00:00
db:JVNDBid:JVNDB-2022-005407date:2023-05-30T00:00:00
db:CNNVDid:CNNVD-202202-1064date:2022-02-11T00:00:00
db:NVDid:CVE-2022-23425date:2022-02-11T18:15:11.320