CVE-2021-25489: low-severity vulnerability in Samsung Mobile Devices
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
A format string vulnerability in the modem interface driver allows an attacker with radio permission to crash the system kernel by sending specially crafted input that isn't properly validated.
The modem interface driver fails to validate user-supplied format strings before processing them, enabling a local attacker with radio privileges to trigger a format string attack that causes kernel panic. Exploitation requires prior radio permission and malicious input to the driver interface.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.