← Vulnerability feed

Vulnerability record · CVE-2019-16401 · published 6 November 2019

CVE-2019-16401: Samsung galaxy s8 plus firmware vulnerability

Samsung · Galaxy S8 Plus Firmware

Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status.

6.5 CVSS 3.1 Medium EPSS 0.51% · top 58.7%
6.5CVSS 3.1 base score, v2 3.3
0.51%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.openconf.org/acsac2019/modules/request.php?module=oc_program&action=summary.php&id=210 Third Party Advisory
https://www.openconf.org/acsac2019/modules/request.php?module=oc_program&action=summary.php&id=210 Third Party Advisory

Track CVE-2019-16401 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2019-16400Samsung galaxy s8 plus firmware vulnerabilitySamsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3)…EPSS 0.46%4.6CVE-2013-4763Samsung galaxy s3 firmware incorrect default permissions vulnerabilitySamsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission.EPSS 0.35%4.3CVE-2013-4764Samsung galaxy s3 firmware incorrect default permissions vulnerabilitySamsung Galaxy S3/S4 exposes an unprotected component allowing an unprivileged app to send arbitrary SMS texts to arbitrary destinations without perm…EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2019-16401), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.