Cyber Resilience

CVE-2023-37367

Access Control in Samsung Exynos 9820 Firmware

Published
08 September 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0044 36th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2023-37367 is a medium-severity Incorrect Authorization (CWE-863) vulnerability in Samsung Exynos 9820 Firmware. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos 9820, Exynos 980, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto…

more

T5123. In the NAS Task, an improperly implemented security check for standard can disallow desired services for a while via consecutive NAS messages.

CWE(s)

Related Threats

CVEs Like This One

CVE-2023-49927Same product: Samsung Exynos 1080
CVE-2023-50803Same product: Samsung Exynos 1080
CVE-2023-49928Same product: Samsung Exynos 1080
CVE-2023-50804Same product: Samsung Exynos 1080
CVE-2023-37368Same product: Samsung Exynos 1080
CVE-2023-41111Same product: Samsung Exynos 1080
CVE-2023-41112Same product: Samsung Exynos 1080
CVE-2024-29152Same product: Samsung Exynos 1080
CVE-2024-25073Same product: Samsung Exynos 1080
CVE-2024-29153Same product: Samsung Exynos 1080

Affected Assets

samsung
exynos 9820 firmware
all versions
samsung
exynos 980 firmware
all versions
samsung
exynos 850 firmware
all versions
samsung
exynos 1080 firmware
all versions
samsung
exynos 2100 firmware
all versions
samsung
exynos 2200 firmware
all versions
samsung
exynos 1280 firmware
all versions
samsung
exynos 1380 firmware
all versions
samsung
exynos 1330 firmware
all versions
samsung
exynos modem 5123 firmware
all versions
+2 more product configuration(s) — see NVD for full list

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-863

Periodic review and update of procedures reduces incorrect authorization implementations over time.

addresses: CWE-863

Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.

addresses: CWE-863

Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.

addresses: CWE-863

The authorization process and usage restrictions help prevent incorrect authorization for remote access types.

addresses: CWE-863

Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.

addresses: CWE-863

Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.

addresses: CWE-863

Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.

addresses: CWE-863

Ensures authorization decisions for external system use are correctly implemented and enforced.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Defining, enforcing, and reviewing access authorizations and least privilege directly prevents incorrect authorization checks.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

prevents

Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.

prevents

By tying access rights to identity, device, location and classification, the control reduces the likelihood that an authorization decision will be based on an incorrect or bypassed policy.

References