PT-2021-16572 · Samsung+1 · Samsung Account+1

Published 2021-04-09 · Updated 2021-04-19 · CVE-2021-25381

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Samsung Account versions 10.8.0.4 and earlier in Android P(9.0) and below Samsung Account versions 12.1.1.3 and earlier in Android Q(10.0) and above

Description: The issue allows local attackers to perform unauthorized actions without permission via hijacking the PendingIntent. This is due to the use of unsafe PendingIntent in Samsung Account.

Recommendations: For Samsung Account versions 10.8.0.4 and earlier in Android P(9.0) and below, update to a version that fixes the unsafe PendingIntent issue. For Samsung Account versions 12.1.1.3 and earlier in Android Q(10.0) and above, update to a version that fixes the unsafe PendingIntent issue. As a temporary workaround, consider restricting access to the Samsung Account feature until a patch is available.

Fix

Improper Authorization

Incorrect Default Permissions

Weakness Enumeration

CWE-285

CWE-276

Related Identifiers

CVE-2021-25381

Affected Products

Android

Samsung Account

References · 5

• https://security.samsungmobile.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25381 · Vendor Advisory
• https://security.samsungmobile.com/serviceWeb.smsb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25381 · Security Note
• https://t.me/cvenotify/13425 · Telegram Post