CVE-2021-25395mediumunder attackCWE-362

CVE-2021-25395: medium-severity vulnerability in Samsung Mobile Devices

Published · Updated

Follow this CVE+ Monitor Samsung Mobile Devices

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.4epss 0.4%
from disclosure to weapon
Published on NVDJun 11
CISA KEV+748d
Action required by CISAfederal deadline: 2023-07-20

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

In short

A timing flaw in the MFC charger driver allows an attacker with radio access to skip security checks that normally verify software authenticity. This could let someone install unauthorized code on the device.

Technical detail

A race condition in the MFC charger driver (pre-May 2021 Release 1) permits bypass of signature verification when radio privileges are compromised. The vulnerability exists in the driver's authentication mechanism during concurrent operations, enabling local attackers to deploy unsigned firmware or malicious code without proper validation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Samsung Mobile · Samsung Mobile Devices
Related CVEs — Samsung Mobile Devices

In the same product, most dangerous first.

CVE-2025-21042HIGHCVE-2025-21042EPSS 35.6%KEVCVE-2021-25337MEDIUMCVE-2021-25337EPSS 2.8%KEVCVE-2023-21492MEDIUMCVE-2023-21492EPSS 2.6%KEVCVE-2025-21043HIGHCVE-2025-21043EPSS 2.2%KEVCVE-2021-25369MEDIUMCVE-2021-25369EPSS 1.1%KEVCVE-2021-25370MEDIUMCVE-2021-25370EPSS 0.9%KEV