CVE-2023-21467 is a medium severity flaw (CVSS 4.6) in the Exynos baseband used in some Samsung devices. The 3GPP implementation handles an unencrypted message incorrectly. Samsung fixed it in its April 2023 security maintenance release, SMR Apr-2023 Release 1, so install that update or any later one.
What's affected
The CVE record says the Exynos baseband prior to SMR Apr-2023 Release 1 is affected. Samsung's April 2023 bulletin lists it as SVE-2022-2755, rated Moderate, with affected versions described as select devices using Exynos CP chipsets. It was reported on 23 November 2022 and privately disclosed.
The bulletin does not list device models in that entry, so the practical test is the security patch level on the device, not the chipset name.
How to check if you're exposed
On a Samsung device, open Settings, then About phone, then Software information, and read the Android security patch level. A level of 1 April 2023 or later carries the fix described for this entry. Device management tools can report the same field in bulk.
If you run a fleet, query the patch level from your mobile device management console and list devices below April 2023. Phones that have stopped receiving updates need a separate decision, because they will not get the fix.
The record gives an attack vector of adjacent network and a high attack complexity, so the risk is narrower than a remote internet bug. That is a reason to prioritise it below the critical items on your list, not to ignore it.
What to do now
- Check the security patch level on managed Samsung devices.
- Install the April 2023 SMR update or any later monthly update.
- Mark devices that no longer receive updates, and decide whether they should keep handling sensitive work.
- Keep monthly patching on a schedule so each bulletin does not need a separate project.
Why it matters
The weakness class is improper authentication (CWE-287). The patch note says it "adds proper authentication logic", which tells you the baseband accepted a message it should have checked. Baseband firmware runs on a separate processor that handles the cellular radio, so flaws there sit below the operating system most security tools can see.
The score is moderate because the record sets the attack vector as adjacent, requires low privileges and rates the attack complexity as high, with limited impact on confidentiality, integrity and availability. This CVE is not on the CISA Known Exploited Vulnerabilities list. For most organisations the answer is routine: keep phones on a current patch level.
Quick check
Is this remotely exploitable over the internet?
The record sets the attack vector as adjacent, so it is not a plain internet attack. It needs proximity or access to the radio side.
How do I know I have the fix?
A Samsung security patch level of April 2023 or later includes SMR Apr-2023 Release 1.
Sources
Last reviewed: 19 October 2026.
