Vulnerabilidades em Samsung Mobile

1.419 resultados
Análise Vexday

Samsung Mobile acumula 1.316 CVEs catalogadas, com 13 confirmadas em exploração ativa pelo CISA KEV — uma taxa 2,2 vezes acima da média geral do catálogo, o que indica exposição operacional relevante e exige atenção prioritária na gestão de patches. O tipo de falha mais recorrente é CWE-20 (validação inadequada de entrada), sugerindo fragilidades sistemáticas no tratamento de dados externos que tendem a gerar superfícies amplas de ataque. A CVE mais perigosa em exploração ativa no momento é CVE-2025-21042, com escore EPSS de 0,1161, enquanto 34 novas vulnerabilidades surgiram nos últimos 90 dias, sinalizando um ritmo de descoberta contínuo que demanda monitoramento frequente. Com apenas 3 CVEs acompanhadas de PoC pública e EPSS máximo observado de 0,1289, o risco de exploração massiva imediata é moderado, mas a combinação de falhas ativas confirmadas e volume crescente de novas entradas justifica ciclos curtos de atualização de firmware em ambientes corporativos.

CVE-2024-20845HIGHOut-of-bounds write vulnerability while releasing memory in libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute arEPSS 0.2%CVE-2022-30721LOWImproper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash.EPSS 0.2%CVE-2021-25373MEDIUMUsing unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in AndEPSS 0.2%CVE-2021-25353MEDIUMUsing empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of GalEPSS 0.2%CVE-2022-30719LOWImproper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash.EPSS 0.2%CVE-2025-20883MEDIUMImproper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profileEPSS 0.2%CVE-2024-49402MEDIUMImproper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profilesEPSS 0.2%CVE-2021-25381MEDIUMUsing unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above alEPSS 0.2%CVE-2022-28791MEDIUMImproper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored EPSS 0.2%CVE-2022-33709—Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch aEPSS 0.2%CVE-2022-33708—Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch aEPSS 0.2%CVE-2022-33710—Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launcEPSS 0.2%CVE-2022-24923MEDIUMImproper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to loEPSS 0.2%CVE-2022-28793MEDIUMGiven the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT EPSS 0.2%CVE-2021-25521MEDIUMInsecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in SEPSS 0.2%CVE-2023-21456CRITICALPath traversal vulnerability in Galaxy Themes Service prior to SMR Mar-2023 Release 1 allows attacker to access arbitrary file with system uEPSS 0.2%CVE-2021-25377LOWIntent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attEPSS 0.2%CVE-2023-42568HIGHImproper access control vulnerability in SmartManagerCN prior to SMR Dec-2023 Release 1 allows local attackers to access arbitrary files witEPSS 0.2%CVE-2025-20898MEDIUMImproper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profilEPSS 0.2%CVE-2021-25499HIGHIntent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access contEPSS 0.2%