Exploited vulnerability

CVE-2021-25369

TLP:CLEAR

Samsung Mobile Devices Improper Access Control Vulnerability

Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.

Facts

Vendor: Samsung
Product: Mobile Devices
CVSS: 6.2
EPSS (probability of exploitation within 30 days): 1.1 %
On CISA's Known Exploited Vulnerabilities list since: 8 November 2022
First known exploitation: 8 November 2022
CISA's deadline for US federal agencies: 29 November 2022
Weakness: CWE-200
First seen by Risk Letters: 8 November 2022

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD