CVE-2023-49928 is a high severity (CVSS 7.5) information disclosure in the baseband software of several Samsung Exynos processors and modems. The baseband does not properly check states set by the RRC protocol. Install your device maker's security updates, and check Samsung's product security page for the patch status.
What's affected
The NVD record lists the affected parts as Exynos 980, 990, 850, 1080, 2100, 2200, 1280, 1380 and 1330, Exynos 9110, Exynos W920, and Exynos Modem 5123 and 5300. The cause, in the record's words, is that the baseband does not properly check states specified by the RRC, the radio resource control layer. The record gives no CWE.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: network reachable, no privileges, high confidentiality impact only. The score is 7.5 High.
Fixed versions: I could not confirm any. The reference is Samsung's product security updates page, and when I checked it the page said it was no longer available and showed no entry for this CVE. Because baseband fixes ship through phone and wearable makers, the practical fix is the next security patch level from your device vendor. Check your vendor bulletin for this CVE number.
How to check if you're exposed
You cannot read the baseband chipset from the application layer on every device, so start with the model. On Android, the model and chipset are visible in the device settings, or through a debug shell on devices you manage.
adb shell getprop ro.board.platform
adb shell getprop ro.hardware.chipname
adb shell getprop ro.build.version.security_patch
Match the chipset to the list above, then look at the security patch level and compare it with your device maker's bulletins. Most Exynos devices ship with Samsung phones and watches, but other vendors also use these parts. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Identify which managed phones and wearables use the listed Exynos parts.
- Check each vendor's security bulletins for CVE-2023-49928 and note the patch level that includes the fix.
- Roll out the vendor update through your mobile device management tool.
- For devices that no longer get updates, restrict access to sensitive data or replace them.
- Re-check the vendor bulletins later, since patch mappings can be added after publication.
Why it matters
The baseband is the processor that handles cellular radio. It runs separately from the main operating system and parses messages from the network. If it does not check the state of a protocol exchange properly, it may respond with data it should keep private.
The vector shows no privileges or user action, which is typical for radio layer flaws, but real attacks on them usually need radio proximity or control of network infrastructure. The record does not describe any details beyond that, and the sources I could read report no exploitation. This CVE is not on the CISA KEV list.
Quick check
Can I patch this from an app?
No. Baseband fixes come through firmware and security patches from your device maker.
Why is there no fixed version listed?
The Samsung page the record points to was unavailable when checked, so I could not confirm a version. Use your vendor's bulletin.
Sources
Last reviewed: 19 October 2026.
