Actively exploited · Published Mar 26, 2021 · Assigned by Samsung Mobile

CVE-2021-25372

Medium 6.1 Exploited

In plain English

A medium-severity security flaw in Samsung Mobile Devices from Samsung Mobile. Attackers are actively exploiting it in the wild (listed by CISA on June 29, 2023). The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.8%top 43.1% of all CVEs

Exploited in the wildYesCISA KEV since Jun 29, 2023

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

Federal agencies must remediate by Jul 20, 2023.

Official description

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

Affected products (as reported)

Vendor	Product	Versions
Samsung Mobile	Samsung Mobile Devices	Q(10.0), R(11.0) devices with exynos980, exynos2100, exynos9830 – before SMR Mar-2021 Release 1

Weakness: CWE-703 · Vector: CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://security.samsungmobile.com/securityUpdate.smsb x_refsource_CONFIRM
https://security.samsungmobile.com x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372 government-resource