CVE-2021-25371mediumunder attackCWE-912

CVE-2021-25371: medium-severity vulnerability in Samsung Mobile Devices

Published · Updated

Follow this CVE+ Monitor Samsung Mobile Devices

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.1epss 0.8%
from disclosure to weapon
Published on NVDMar 26
CISA KEV+825d
Action required by CISAfederal deadline: 2023-07-20

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

In short

A flaw in the DSP driver lets attackers load unauthorized ELF libraries into the Digital Signal Processor, potentially allowing them to execute malicious code in a privileged environment.

Technical detail

The DSP driver prior to SMR Mar-2021 Release 1 lacks proper validation of ELF library sources, enabling an attacker to inject arbitrary libraries with elevated privileges. This requires local access but can lead to code execution within the DSP context, bypassing normal security boundaries.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Samsung Mobile · Samsung Mobile Devices
Related CVEs — Samsung Mobile Devices

In the same product, most dangerous first.

CVE-2025-21042HIGHCVE-2025-21042EPSS 35.6%KEVCVE-2021-25337MEDIUMCVE-2021-25337EPSS 2.8%KEVCVE-2023-21492MEDIUMCVE-2023-21492EPSS 2.6%KEVCVE-2025-21043HIGHCVE-2025-21043EPSS 2.2%KEVCVE-2021-25369MEDIUMCVE-2021-25369EPSS 1.1%KEVCVE-2021-25370MEDIUMCVE-2021-25370EPSS 0.9%KEV