Multiple vulnerabilities in Samsung products
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 6 |
| CVE-ID | CVE-2021-25397 CVE-2021-25393 CVE-2021-25392 CVE-2021-25391 CVE-2021-25390 CVE-2021-25388 |
| CWE-ID | CWE-284 CWE-20 CWE-200 CWE-287 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
Samsung P Client/Desktop applications / Multimedia software Samsung Q Client/Desktop applications / Multimedia software Samsung R Client/Desktop applications / Multimedia software Samsung O Client/Desktop applications / Multimedia software |
| Vendor | Samsung |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
1) Improper access control
EUVDB-ID: #VU54075
Risk: Low
CVSSv4.0: 6.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-25397
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in TelephonyUI. A local attacker can write arbitrary files of telephony process via untrusted applications.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSamsung P: 9.0
Samsung Q: 10.0
Samsung R: 11
CPE2.3- cpe:2.3:a:samsung:samsung_p:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:samsung:samsung_q:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:samsung:samsung_r:11:*:*:*:*:*:*:*
https://security.samsungmobile.com/securityUpdate.smsb
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU54074
Risk: Low
CVSSv4.0: 6.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-25393
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to compromise the target system.
The vulnerability exists due to improper sanitization of incoming intent in SecSettings. A local attacker can get permissions to access system uid data.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSamsung Q: 10.0
Samsung R: 11
CPE2.3 External linkshttps://security.samsungmobile.com/securityUpdate.smsb
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Information disclosure
EUVDB-ID: #VU54073
Risk: Low
CVSSv4.0: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-25392
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to gain access to potentially sensitive information.
The vulnerability exists due to improper protection of backup path configuration in Samsung Dex. A local attacker can gain access to sensitive information via changing the path.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSamsung P: 9.0
Samsung Q: 10.0
Samsung R: 11
CPE2.3- cpe:2.3:a:samsung:samsung_p:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:samsung:samsung_q:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:samsung:samsung_r:11:*:*:*:*:*:*:*
https://security.samsungmobile.com/securityUpdate.smsb
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Input validation error
EUVDB-ID: #VU54072
Risk: Low
CVSSv4.0: 6.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-25391
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to compromise the target system.
The vulnerability exists due to intent redirection issue in Secure Folder. A local attacker can execute privileged action.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSamsung R: 11
CPE2.3 External linkshttps://security.samsungmobile.com/securityUpdate.smsb
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Input validation error
EUVDB-ID: #VU54071
Risk: Low
CVSSv4.0: 6.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-25390
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to compromise the target system.
The vulnerability exists due to intent redirection issue in PhotoTable. A local attacker can execute privileged action.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSamsung O: 8.1
Samsung P: 9.0
Samsung Q: 10.0
Samsung R: 11
CPE2.3- cpe:2.3:a:samsung:samsung_o:8.1:*:*:*:*:*:*:*
- cpe:2.3:a:samsung:samsung_p:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:samsung:samsung_q:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:samsung:samsung_r:11:*:*:*:*:*:*:*
https://security.samsungmobile.com/securityUpdate.smsb
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Improper Authentication
EUVDB-ID: #VU54070
Risk: Low
CVSSv4.0: 6.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-25388
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to bypass authentication process.
The vulnerability exists due to improper caller check issue in Knox Core. A local attacker can install arbitrary app.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSamsung R: 11
CPE2.3 External linkshttps://security.samsungmobile.com/securityUpdate.smsb
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
