Vulnerabilities in Samsung Mobile

1,316 results
Vexday analysis

Samsung Mobile acumula 1.316 CVEs catalogadas, com 13 confirmadas em exploração ativa pelo CISA KEV — uma taxa 2,2 vezes acima da média geral do catálogo, o que indica exposição operacional relevante e exige atenção prioritária na gestão de patches. O tipo de falha mais recorrente é CWE-20 (validação inadequada de entrada), sugerindo fragilidades sistemáticas no tratamento de dados externos que tendem a gerar superfícies amplas de ataque. A CVE mais perigosa em exploração ativa no momento é CVE-2025-21042, com escore EPSS de 0,1161, enquanto 34 novas vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo de descoberta contínuo que demanda monitoramento frequente. Com apenas 3 CVEs acompanhadas de PoC pública e EPSS máximo observado de 0,1289, o risco de exploração massiva imediata é moderado, mas a combinação de falhas ativas confirmadas e volume crescente de novas entradas justifica ciclos curtos de atualização de firmware em ambientes corporativos.

CVE-2023-30731MEDIUMLogic error in package installation via debugger command prior to SMR Oct-2023 Release 1 allows physical attacker to install an application EPSS 0.2%CVE-2022-27838HIGHImproper access control vulnerability in FactoryCamera prior to version 2.1.96 allows attacker to access the file with system privilege.EPSS 0.2%CVE-2024-20813HIGHOut-of-bounds Write in padmd_vld_qtbl of libpadm.so prior to SMR Feb-2024 Release 1 allows local attacker to execute arbitrary code.EPSS 0.2%CVE-2024-34639MEDIUMImproper handling of exceptional conditions in Setupwizard prior to SMR Aug-2024 Release 1 allows physical attackers to bypass proper validaEPSS 0.2%CVE-2021-25439—Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android PEPSS 0.2%CVE-2025-21075MEDIUMOut-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory.EPSS 0.2%CVE-2025-58479MEDIUMOut-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.EPSS 0.2%CVE-2022-25824MEDIUMImproper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrarEPSS 0.2%CVE-2024-20889MEDIUMImproper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices.EPSS 0.2%CVE-2022-22284MEDIUMImproper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authenticationEPSS 0.2%CVE-2023-30677MEDIUMImproper access control vulnerability in Samsung Pass prior to version 4.2.03.1 allows physical attackers to access data of Samsung Pass on EPSS 0.2%CVE-2021-25352MEDIUMUsing PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijackinEPSS 0.2%CVE-2024-34642MEDIUMImproper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information.EPSS 0.2%CVE-2024-20827MEDIUMImproper access control vulnerability in Samsung Gallery prior to version 14.5.04.4 allows physical attackers to access the picture using phEPSS 0.2%CVE-2023-30676MEDIUMImproper access control vulnerability in Samsung Pass prior to version 4.2.03.1 allows physical attackers to access data of Samsung Pass.EPSS 0.2%CVE-2021-25433—Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications tEPSS 0.2%CVE-2021-25524MEDIUMInsecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID.EPSS 0.2%CVE-2024-49411MEDIUMPath Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenterEPSS 0.2%CVE-2021-25523MEDIUMInsecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Account ID.EPSS 0.2%CVE-2021-25451LOWA PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data.EPSS 0.2%