7.1

CVE-2021-25337

Warnung
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Samsung ≫ Android Version 9.0 Update smr-apr-2019-r1
Samsung ≫ Android Version 9.0 Update smr-apr-2020-r1
Samsung ≫ Android Version 9.0 Update smr-aug-2019-r1
Samsung ≫ Android Version 9.0 Update smr-aug-2020-r1
Samsung ≫ Android Version 9.0 Update smr-dec-2018-r1
Samsung ≫ Android Version 9.0 Update smr-dec-2019-r1
Samsung ≫ Android Version 9.0 Update smr-dec-2020-r1
Samsung ≫ Android Version 9.0 Update smr-feb-2019-r1
Samsung ≫ Android Version 9.0 Update smr-feb-2020-r1
Samsung ≫ Android Version 9.0 Update smr-feb-2021-r1
Samsung ≫ Android Version 9.0 Update smr-jan-2019-r1
Samsung ≫ Android Version 9.0 Update smr-jan-2020-r1
Samsung ≫ Android Version 9.0 Update smr-jan-2021-r1
Samsung ≫ Android Version 9.0 Update smr-jul-2019-r1
Samsung ≫ Android Version 9.0 Update smr-jul-2020-r1
Samsung ≫ Android Version 9.0 Update smr-jun-2019-r1
Samsung ≫ Android Version 9.0 Update smr-jun-2020-r1
Samsung ≫ Android Version 9.0 Update smr-mar-2019-r1
Samsung ≫ Android Version 9.0 Update smr-mar-2020-r1
Samsung ≫ Android Version 9.0 Update smr-may-2019-r1
Samsung ≫ Android Version 9.0 Update smr-may-2020-r1
Samsung ≫ Android Version 9.0 Update smr-nov-2018-r1
Samsung ≫ Android Version 9.0 Update smr-nov-2019-r1
Samsung ≫ Android Version 9.0 Update smr-nov-2020-r1
Samsung ≫ Android Version 9.0 Update smr-oct-2018-r1
Samsung ≫ Android Version 9.0 Update smr-oct-2019-r1
Samsung ≫ Android Version 9.0 Update smr-oct-2020-r1
Samsung ≫ Android Version 9.0 Update smr-sep-2019-r1
Samsung ≫ Android Version 9.0 Update smr-sep-2020-r1
Samsung ≫ Android Version 10.0 Update smr-apr-2020-r1
Samsung ≫ Android Version 10.0 Update smr-aug-2020-r1
Samsung ≫ Android Version 10.0 Update smr-dec-2019-r1
Samsung ≫ Android Version 10.0 Update smr-dec-2020-r1
Samsung ≫ Android Version 10.0 Update smr-feb-2020-r1
Samsung ≫ Android Version 10.0 Update smr-feb-2021-r1
Samsung ≫ Android Version 10.0 Update smr-jan-2020-r1
Samsung ≫ Android Version 10.0 Update smr-jan-2021-r1
Samsung ≫ Android Version 10.0 Update smr-jul-2020-r1
Samsung ≫ Android Version 10.0 Update smr-jun-2020-r1
Samsung ≫ Android Version 10.0 Update smr-mar-2020-r1
Samsung ≫ Android Version 10.0 Update smr-may-2020-r1
Samsung ≫ Android Version 10.0 Update smr-nov-2019-r1
Samsung ≫ Android Version 10.0 Update smr-nov-2020-r1
Samsung ≫ Android Version 10.0 Update smr-oct-2020-r1
Samsung ≫ Android Version 10.0 Update smr-sep-2020-r1
Samsung ≫ Android Version 11.0 Update smr-dec-2020-r1
Samsung ≫ Android Version 11.0 Update smr-feb-2021-r1
Samsung ≫ Android Version 11.0 Update smr-jan-2021-r1

08.11.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Samsung Mobile Devices Improper Access Control Vulnerability

Schwachstelle

Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.83% 0.848
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
mobile.security@samsung.com 4.4 1.8 2.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://security.samsungmobile.com/securityUpdate.smsb
Vendor Advisory
https://security.samsungmobile.com
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25337
US Government Resource