PT-2021-16588 · Unknown · Telephonyui

Sergey Toshin · Published 2021-06-11 · Updated 2022-10-25 · CVE-2021-25397

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions: TelephonyUI versions prior to SMR MAY-2021 Release 1

Description: The issue is related to improper access control in TelephonyUI, allowing local attackers to write arbitrary files of the telephony process via untrusted applications. This can be exploited by local attackers.

Recommendations: For versions prior to SMR MAY-2021 Release 1, update to SMR MAY-2021 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to untrusted applications to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-926

Related Identifiers

CVE-2021-25397

Affected Products

Telephonyui

References · 6

• 🔥 https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1 · Exploit
• https://osv.dev/vulnerability/CVE-2021-25397 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25397 · Security Note
• https://t.me/cibsecurity/25382 · Telegram Post
• https://t.me/cvenotify/16207 · Telegram Post