Risk | Low |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2024-20839 CVE-2024-20840 |
CWE-ID | CWE-284 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
Voice Recorder Mobile applications / Apps for mobile phones |
Vendor |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU87114
Risk: Low
CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-20839
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. An attacker with physical access can access recording files on the lock screen.
MitigationInstall updates from vendor's website.
Vulnerable software versionsVoice Recorder: before 21.5.16.01
External linkshttp://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=03
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU87115
Risk: Low
CVSSv3.1: 2.1 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-20840
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. An attacker with physical access can use hardware keyboard to use VoiceRecorder on the lock screen.
MitigationInstall updates from vendor's website.
Vulnerable software versionsVoice Recorder: before 21.5.16.01
External linkshttp://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=03
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.