PT-2025-20045 · Unknown · Cocktailbarservice

Balance · Published 2025-05-07 · Updated 2025-05-07 · CVE-2025-20960

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CocktailBarService versions prior to SMR May-2025 Release 1

Description The issue is related to the improper handling of insufficient permissions in CocktailBarService, allowing local attackers to use the privileged API. This enables local attackers to exploit the vulnerability.

Recommendations For versions prior to SMR May-2025 Release 1, consider restricting access to the privileged API until a patch is available. As a temporary workaround, review and adjust the permission settings in CocktailBarService to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-20960

Affected Products

Cocktailbarservice

References · 7

• https://osv.dev/vulnerability/CVE-2025-20960 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=05 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20960 · Security Note
• https://t.me/cvedetector/24705 · Telegram Post
• https://t.me/cvetracker/23236 · Telegram Post
• https://twitter.com/CVEnew/status/1920038110609453295 · Twitter Post
• https://t.me/cvenotify/121169 · Telegram Post