PT-2022-17539 · Unknown · Wearable Manager Installer

H0Rd7 · Published 2022-03-08 · Updated 2022-03-16 · CVE-2022-25814

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wearable Manager Installer versions prior to SMR Mar-2022 Release 1

Description The issue allows local attackers to perform unauthorized actions without permission by hijacking the PendingIntent. This can lead to exploitation where attackers gain access to perform actions that are not authorized.

Recommendations For versions prior to SMR Mar-2022 Release 1, update to SMR Mar-2022 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Wearable Manager Installer to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-25814

Affected Products

Wearable Manager Installer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-25814 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25814 · Vendor Advisory
• https://t.me/cibsecurity/38685 · Telegram Post