PT-2025-21229 · Samsung · Samsung Galaxy Buds+1

Published 2025-05-14 · Updated 2025-05-19 · CVE-2024-58101

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Samsung Galaxy Buds and Galaxy Buds 2 (affected versions not specified)

Description: The issue concerns Samsung Galaxy Buds and Galaxy Buds 2 audio devices being Bluetooth pairable by default without requiring user input or providing a means to disable this mode. This allows for potential audio playback takeover or unauthorized microphone recording without user consent or notification.

Recommendations: For Samsung Galaxy Buds and Galaxy Buds 2, consider disabling the Bluetooth pairing feature by default as a temporary workaround until a patch is available. Restrict access to the device's microphone to minimize the risk of unauthorized recording. Avoid using the devices in sensitive environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-58101

Affected Products

Galaxy Buds 2

Samsung Galaxy Buds

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-58101 · Security Note
• https://t.me/cvetracker/23858 · Telegram Post
• https://tarlogic.com/blog/cve-2024-58101 · Note
• https://twitter.com/Tarlogic/status/1924412592400777506 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1922810294109114617 · Twitter Post
• https://twitter.com/CVEnew/status/1922765622041247907 · Twitter Post