PT-2021-16583 · Samsung · Samsung Dex

Published 2021-06-11 · Updated 2021-06-16 · CVE-2021-25392

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Samsung Dex versions prior to SMR MAY-2021 Release 1

Description: The issue is related to improper protection of backup path configuration, allowing local attackers to obtain sensitive information by changing the path. This can be exploited to gain unauthorized access to sensitive data.

Recommendations: For versions prior to SMR MAY-2021 Release 1, update to SMR MAY-2021 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the backup path configuration to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Inadequate Encryption Strength

Weakness Enumeration

CWE-200

CWE-326

Related Identifiers

CVE-2021-25392

Affected Products

Samsung Dex

References · 5

• 🔥 https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1 · Exploit
• https://osv.dev/vulnerability/CVE-2021-25392 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25392 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5 · Vendor Advisory
• https://t.me/cvenotify/16489 · Telegram Post