Actively exploited · Published Jun 11, 2021 · Assigned by Samsung Mobile
CVE-2021-25395
Medium 6.4 Exploited
In plain English
A medium-severity race condition in Samsung Mobile Devices from Samsung Mobile. Attackers are actively exploiting it in the wild (listed by CISA on June 29, 2023). The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
CISA guidance
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Federal agencies must remediate by Jul 20, 2023.
Official description
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Samsung Mobile | Samsung Mobile Devices | O(8.x), P(9.0), Q(10.0), R(11.0) – before SMR MAY-2021 Release 1 |
Weakness: CWE-362 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H