Actively exploited · Published Oct 6, 2021 · Assigned by Samsung Mobile
CVE-2021-25489
Low 3.3 Exploited
In plain English
A low-severity improper input validation in Samsung Mobile Devices from Samsung Mobile. Attackers are actively exploiting it in the wild (listed by CISA on June 29, 2023). The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
CISA guidance
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Federal agencies must remediate by Jul 20, 2023.
Official description
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Samsung Mobile | Samsung Mobile Devices | O(8.1), P(9.0), Q(10.0), R(11.0) – before SMR Oct-2021 Release 1 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L