PT-2023-28441 · Samsung · Find My Mobile

Ademar Nowasky Junior · Published 2023-12-04 · Updated 2023-12-11 · CVE-2023-42571

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Find My Mobile versions prior to 7.3.13.4

Description The issue allows a physical attacker to unlock a device remotely by resetting the Samsung Account password with SMS verification when the user has lost the device. This is possible due to the abuse of remote unlock in Find My Mobile.

Recommendations For versions prior to 7.3.13.4, update to version 7.3.13.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the remote unlock feature in Find My Mobile until the update is applied.

Fix

Related Identifiers

CVE-2023-42571

Affected Products

Find My Mobile

References · 5

• https://osv.dev/vulnerability/CVE-2023-42571 · Vendor Advisory
• https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42571 · Security Note
• https://twitter.com/CVEnew/status/1731869112324759787 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1731926562407166406 · Twitter Post