PT-2025-19994 · Unknown · Smp Act.Cc

Published 2025-05-01 · Updated 2025-09-04 · CVE-2025-26438

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions smp act.cc (affected versions not specified)

Description An incorrect implementation of a protocol in the smp process secure connection oob data function within smp act.cc may allow bypassing SMP authentication. This could lead to remote escalation of privilege without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ASB-A-251514171

CVE-2025-26438

Affected Products

Smp Act.Cc

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-26438 · Security Note
• https://source.android.com/security/bulletin/2025-05-01 · Vendor Advisory
• https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e6130675c04752947ac4779c178ce70eb959a97f · Patch
• https://osv.dev/vulnerability/CVE-2025-26438 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-251514171 · Vendor Advisory
• https://twitter.com/xvonfers/status/1919841720046408137 · Twitter Post
• https://twitter.com/CVEnew/status/1963655966785773940 · Twitter Post
• https://t.me/cveNotify/134326 · Telegram Post