PT-2021-16549 · Unknown · Managed Provisioning

Published 2021-04-09 · Updated 2022-08-24 · CVE-2021-25356

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Managed Provisioning versions prior to SMR APR-2021 Release 1

Description: The issue is related to an improper caller check in Managed Provisioning, allowing an unprivileged application to install arbitrary applications, grant device admin permission, and then delete several installed applications.

Recommendations: For versions prior to SMR APR-2021 Release 1, update to SMR APR-2021 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting the installation of arbitrary applications and granting of device admin permissions to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

RCE

Weakness Enumeration

CWE-863

CWE-20

Related Identifiers

CVE-2021-25356

Affected Products

Managed Provisioning

References · 6

• 🔥 https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1 · Exploit
• https://security.samsungmobile.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25356 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25356 · Vendor Advisory
• https://t.me/cvenotify/13026 · Telegram Post