PT-2025-23755 · Samsung · Samsung Internet

Kun19 + 3 · Published 2025-06-04 · Updated 2025-12-05 · CVE-2025-20994

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Samsung Internet versions prior to 28.0.0.59

Description The issue arises from improper handling of insufficient permission in SyncClientProvider, allowing local attackers to access and modify arbitrary files. This affects Samsung Internet installed on non-Samsung devices.

Recommendations For versions prior to 28.0.0.59, update to version 28.0.0.59 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2025-20994

Affected Products

Samsung Internet

References · 8

• https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=06 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-20994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20994 · Security Note
• https://twitter.com/CVEnew/status/1930131531256701314 · Twitter Post
• https://t.me/cveNotify/144822 · Telegram Post
• https://twitter.com/dailycve/status/1996856340682362902 · Twitter Post
• https://t.me/cvetracker/25361 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930185390188527942 · Twitter Post