[ CVE-2021-25337 · Published 4 Mar 2021 ]
Samsung Mobile Devices Improper Access Control Vulnerability
Exploited · CISA KEV CVSS 7.1
EPSS 3%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-11-08
[ Description ]Official description
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
CISA: Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 29 Nov 2022): Apply updates per vendor instructions.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- security.samsungmobile.comVendor Advisory
- security.samsungmobile.com/securityUpdate.smsbVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource