[ CVE-2021-25371 · Published 26 Mar 2021 ]

Samsung Mobile Devices Unspecified Vulnerability

Exploited · CISA KEV CVSS 6.7 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-06-29

[ Description ]Official description

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

CISA: Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 20 Jul 2023): Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

security.samsungmobile.comVendor Advisory
security.samsungmobile.com/securityUpdate.smsbVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource