CVE-2021-25337mediumunder attackCWE-269

CVE-2021-25337: medium-severity vulnerability in Samsung Mobile Devices

Published · Updated

Follow this CVE+ Monitor Samsung Mobile Devices

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 4.4epss 2.8%
from disclosure to weapon1870 days
Published on NVDMar 4
1st PoC+1870d
CISA KEV+614d
Action required by CISAfederal deadline: 2022-11-29

Apply updates per vendor instructions.

In short

Untrusted apps on Samsung phones could read or write files through a flaw in the clipboard service, allowing them to access sensitive local data without proper permission checks.

Technical detail

A flaw in the clipboard service (CWE-269: improper access control) in Samsung mobile devices prior to SMR Mar-2021 Release 1 permits untrusted applications to bypass authorization checks and read/write arbitrary local files. Attack vector is local; attacker requires installation of a malicious app.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
Samsung Mobile · Samsung Mobile Devices
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Samsung Mobile Devices

In the same product, most dangerous first.

CVE-2025-21042HIGHCVE-2025-21042EPSS 35.6%KEVCVE-2023-21492MEDIUMCVE-2023-21492EPSS 2.6%KEVCVE-2025-21043HIGHCVE-2025-21043EPSS 2.2%KEVCVE-2021-25369MEDIUMCVE-2021-25369EPSS 1.1%KEVCVE-2021-25370MEDIUMCVE-2021-25370EPSS 0.9%KEVCVE-2021-25372MEDIUMCVE-2021-25372EPSS 0.8%KEV