PT-2023-18268 · Samsung · Knox

Published 2023-06-28 · Updated 2023-07-07 · CVE-2023-21512

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samsung products prior to SMR Jun-2023 Release 1

Description The issue is related to improper Knox ID validation logic in the notification framework, allowing local attackers to read work profile notifications without proper access permission.

Recommendations For versions prior to SMR Jun-2023 Release 1, update to the SMR Jun-2023 Release 1 or later to resolve the issue.

Fix

Incorrect Default Permissions

Improper Privilege Management

Weakness Enumeration

CWE-276

CWE-269

Related Identifiers

CVE-2023-21512

Affected Products

Knox

References · 5

• https://osv.dev/vulnerability/CVE-2023-21512 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=06 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21512 · Security Note
• https://t.me/cvenotify/53863 · Telegram Post
• https://t.me/cibsecurity/65685 · Telegram Post