CVE-2025-22377: n/a
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 27 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
Given the absence of official patches at this time, European organizations should implement layered mitigations. First, monitor for firmware and software updates from Samsung and apply them promptly once available. Network-level protections should be enhanced by filtering or inspecting GPRS traffic to detect and block malformed or suspicious payloads that could exploit the length mismatch. Deploy intrusion detection/prevention systems (IDS/IPS) with updated signatures targeting this vulnerability once released. Organizations should enforce strict device management policies, including limiting the use of vulnerable devices in sensitive environments and isolating them on segmented networks. Employ endpoint protection solutions capable of detecting anomalous memory corruption behaviors. Additionally, educating users about the risks and encouraging minimal exposure to untrusted networks can reduce attack surface. For critical deployments, consider alternative devices or chipsets until patches are confirmed. Finally, maintain active threat intelligence monitoring for any emerging exploit attempts related to CVE-2025-22377.
Description
An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. A Heap-based Out-of-Bounds Write exists in the GPRS protocol implementation because of a mismatch between the actual length of the payload and the length declared within the payload.