Discovered CVEs

Jan 4, 2026 · 7 min read

This page lists CVEs (Common Vulnerabilities and Exposures) discovered and responsibly disclosed by my group (SysSec Lab) and collaborators, across cellular/baseband, mobile telephony, and networked devices. Entries are listed in reverse chronological order (most recent first).

  1. CVE-2026-56975 — Reserved
  2. CVE-2026-56967 — Reserved
  3. CVE-2026-28967 — An attacker in a privileged network position can cause telephony denial of service — Vendor: Apple — CVSS: 4.9 — Reported by: Hazem Issa and Yongdae Kim
  4. CVE-2026-28875 — A remotely triggered baseband buffer overflow can cause denial of service — Vendor: Apple — CVSS: 7.5 — Reported by: Tuan Dinh Hoang, Hazem Issa, and Yongdae Kim
  5. CVE-2026-28874 — A remote attacker can cause unexpected application termination through malformed baseband input — Vendor: Apple — CVSS: 7.5 — Reported by: Hazem Issa, Tuan Dinh Hoang, and Yongdae Kim
  6. CVE-2026-28858 — A remotely triggered telephony buffer overflow can terminate the system or corrupt kernel memory — Vendor: Apple — CVSS: 9.8 — Reported by: Hazem Issa and Yongdae Kim
  7. CVE-2026-20499 — Reserved
  8. CVE-2026-20449 — A heap buffer overflow while processing malformed 5G MAC PDUs enables remote denial of service through a rogue base station — Vendor: MediaTek — CVSS: 6.5 — Reported by: Tuan Dinh Hoang, Hazem Issa, and Yongdae Kim
  9. CVE-2026-0159 — Improper handling of Rejected NSSAI information in a 5G Registration Accept message — Vendor: Google — CVSS: Not publicly available — Reported by: Martin Crettol, Beomseok Oh, and Yongdae Kim
  10. CVE-2026-0110 — Memory corruption in 5G NR modem processing can enable remote privilege escalation — Vendor: Google — CVSS: 9.8 — Reported by: Martin Crettol, Beomseok Oh, and Yongdae Kim
  11. CVE-2025-47371 — Processing a malformed LTE RLC transport block can cause a transient modem denial of service — Vendor: Qualcomm — CVSS: 6.5 — Reported by: Tuan Dinh Hoang
  12. CVE-2025-36917 — An incorrect bounds check in the PDCP security path permits remote denial of service — Vendor: Google — CVSS: 6.5 — Reported by: Tuan Dinh Hoang, Yongdae Kim, and CheolJun Park
  13. CVE-2025-36912 — A logic error in cellular modem message processing permits remote denial of service — Vendor: Google — CVSS: 6.5 — Reported by: Beomseok Oh and Yongdae Kim
  14. CVE-2025-26782 — Incorrect handling of RLC acknowledged-mode PDUs leads to denial of service — Vendor: Samsung — CVSS: 7.5 — Reported by: Tuan Dinh Hoang, Yongdae Kim, and CheolJun Park
  15. CVE-2025-26781 — Incorrect handling of RLC acknowledged-mode PDUs leads to denial of service — Vendor: Samsung — CVSS: 7.5 — Reported by: Tuan Dinh Hoang, Yongdae Kim, and CheolJun Park
  16. CVE-2025-26780 — A missing length check in PDCP packet processing leads to denial of service — Vendor: Samsung — CVSS: 7.5 — Reported by: Tuan Dinh Hoang, Yongdae Kim, Insu Yun, and CheolJun Park
  17. CVE-2025-21477 — Incorrect processing of a CCCH subheader length can cause a transient modem denial of service — Vendor: Qualcomm — CVSS: 7.5 — Reported by: Tuan Dinh Hoang, CheolJun Park, Mincheol Son, Taekkyung Oh, and Yongdae Kim
  18. CVE-2025-21452 — An invalid LTE random-access response PDU length can cause a transient modem denial of service — Vendor: Qualcomm — CVSS: 7.5 — Reported by: Tuan Dinh Hoang, CheolJun Park, Mincheol Son, Taekkyung Oh, and Yongdae Kim
  19. CVE-2025-20755 — Improper validation of an EAP message can remotely crash the modem through a rogue base station — Vendor: MediaTek — CVSS: 5.3 — Reported by: Martin Crettol, Beomseok Oh, and Yongdae Kim
  20. CVE-2025-20708 — An out-of-bounds write in 5G PDCP processing can enable remote privilege escalation through a rogue base station — Vendor: MediaTek — CVSS: 8.8 — Reported by: Tuan Dinh Hoang, Taekkyung Oh, Yongdae Kim, CheolJun Park, and Insu Yun
  21. CVE-2025-20659 — Improper validation of malformed PDCP packets allows a rogue base station to cause remote denial of service — Vendor: MediaTek — CVSS: 6.5 — Reported by: Tuan Dinh Hoang, Yongdae Kim, and CheolJun Park
  22. CVE-2024-48883 — Incorrect handling of a malformed uplink scheduling message leaks UE information — Vendor: Samsung — CVSS: 4.3 — Reported by: Taekkyung Oh, Beomseok Oh, Hansung Bae, Taisic Yun, and Yongdae Kim
  23. CVE-2024-27870 — Incorrect handling of a CCCH length field can remotely crash the baseband; the issue overlaps CVE-2025-21477 — Vendor: Apple — CVSS: Not publicly available — Reported by: Tuan Dinh Hoang, Taekkyung Oh, CheolJun Park, Insu Yun, and Yongdae Kim
  24. CVE-2024-23385 — An invalid MAC random-access response PDU length can reset the modem and cause transient denial of service — Vendor: Qualcomm — CVSS: 7.5 — Reported by: Tuan Dinh Hoang, CheolJun Park, Mincheol Son, Taekkyung Oh, and Yongdae Kim
  25. CVE-2024-20077 — Incorrect processing of malformed MAC control elements can remotely crash the modem — Vendor: MediaTek — CVSS: 7.5 — Reported by: Tuan Dinh Hoang, CheolJun Park, Mincheol Son, Taekkyung Oh, and Yongdae Kim
  26. CVE-2024-20076 — Incorrect error handling of malformed MAC packets can remotely crash the modem — Vendor: MediaTek — CVSS: 7.5 — Reported by: Tuan Dinh Hoang, CheolJun Park, Mincheol Son, Taekkyung Oh, and Yongdae Kim
  27. CVE-2024-20039 — An out-of-bounds write in modem protocol processing can enable remote code execution — Vendor: MediaTek — CVSS: 8.8 — Reported by: CheolJun Park and Marc Egli
  28. CVE-2023-37366 — An unreachable-exit loop can prevent termination of a required baseband service — Vendor: Samsung — CVSS: 5.9 — Reported by: Individual credit not publicly listed
  29. CVE-2023-32890 — Improper input validation in the mobility-management protocol can remotely crash the modem — Vendor: MediaTek — CVSS: 7.5 — Reported by: CheolJun Park and Marc Egli
  30. CVE-2022-40536 — Improper authentication of a plain over-the-air request can cause a transient denial of service — Vendor: Qualcomm — CVSS: 7.5 — Reported by: CheolJun Park, KAIST SysSec Lab
  31. CVE-2022-40521 — Improper authorization handling in modem procedures can cause a transient denial of service — Vendor: Qualcomm — CVSS: 7.5 — Reported by: CheolJun Park, KAIST SysSec Lab
  32. CVE-2022-23425 — Improper input validation allows a fake base station to send arbitrary LTE NAS signaling messages — Vendor: Samsung — CVSS: 9.8 (NVD; vendor score 8.6) — Reported by: Eunsoo Kim, Min Woo Baek, CheolJun Park, Dongkwan Kim, Yongdae Kim, and Insu Yun
  33. CVE-2021-30826 — The baseband can fail to enable integrity and ciphering protection in certain situations — Vendor: Apple — CVSS: 7.5 — Reported by: CheolJun Park, Sangwook Bae, and BeomSeok Oh
  34. CVE-2021-25516 — Improper handling of exceptional baseband conditions enables location tracking — Vendor: Samsung — CVSS: 6.4 — Reported by: CheolJun Park, Sangwook Bae, and BeomSeok Oh
  35. CVE-2019-20783 — LTE authentication and key agreement can be bypassed on affected mobile devices — Vendor: LG Electronics — CVSS: 6.4 — Reported by: LTEFuzz research team
  36. CVE-2019-20084 — Reserved — D-Link
  37. CVE-2019-20082 — Buffer overflow triggered by overly long DNS configuration values — Vendor: ASUS — CVSS: 9.8 — Reported by: Mingeun Kim, KAIST SysSec Lab
  38. CVE-2019-11400 — Stack-based buffer overflow through a crafted ccp_act request parameter — Vendor: TRENDnet — CVSS: 9.8 — Reported by: Mingeun Kim, KAIST SysSec Lab
  39. CVE-2019-11399 — OS command injection through the LAN host-name configuration parameter — Vendor: TRENDnet — CVSS: 9.8 — Reported by: Mingeun Kim, KAIST SysSec Lab
  40. CVE-2019-6258 — Buffer overflow triggered by an overly long MacAddress value in SetClientInfo — Vendor: D-Link — CVSS: 9.8 — Reported by: Mingeun Kim, KAIST SysSec Lab
  41. CVE-2019-5307 — LTE message replay may alter a temporary subscriber identifier or expose the permanent subscriber identity — Vendor: Huawei — CVSS: 4.2 — Reported by: Yongdae Kim, Hongil Kim, Jiho Lee, and Eunkyu Lee
  42. CVE-2019-2289 — Missing integrity verification allows arbitrary LTE NAS messages to be accepted, enabling authentication bypass — Vendor: Qualcomm — CVSS: 9.8 — Reported by: KAIST SysSec Lab
  43. CVE-2018-20114 — Unauthenticated remote command execution through a crafted service parameter in soap.cgi — Vendor: D-Link — CVSS: 9.8 — Reported by: Mingeun Kim, KAIST SysSec Lab
  44. CVE-2018-19990 — OS command injection through the WPSPIN field in SetWiFiVerifyAlpha — Vendor: D-Link — CVSS: 9.8 — Reported by: Mingeun Kim, KAIST SysSec Lab
  45. CVE-2018-19989 — OS command injection through the uplink field in SetQoSSettings — Vendor: D-Link — CVSS: 9.8 — Reported by: Mingeun Kim, KAIST SysSec Lab
  46. CVE-2018-19988 — OS command injection through the AudioMute or AudioEnable field in SetClientInfoDemo — Vendor: D-Link — CVSS: 9.8 — Reported by: Mingeun Kim, KAIST SysSec Lab
  47. CVE-2018-19987 — OS command injection through the IsAccessPoint field in SetAccessPointMode — Vendor: D-Link — CVSS: 9.8 — Reported by: Mingeun Kim, KAIST SysSec Lab
  48. CVE-2018-19986 — OS command injection through the RemotePort field in SetRouterSettings — Vendor: D-Link — CVSS: 9.8 — Reported by: Mingeun Kim, KAIST SysSec Lab
  49. CVE-2015-6614 — Crafted applications can bypass telephony interface restrictions, enabling unauthorized data transfers or denial of service — Vendor: Google/Android — CVSS: 5.8 (v2) — Reported by: Hongil Kim, Dongkwan Kim, Minhee Kwon, Hyungseok Han, Yeongjin Jang, Dongsu Han, Taesoo Kim, and Yongdae Kim