PT-2025-4166 · Samsung · Samsung Message

Published 2025-02-04 · Updated 2025-02-12 · CVE-2025-20884

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samsung Message versions prior to SMR Jan-2025 Release 1

Description The issue is related to improper access control in Samsung Message, allowing physical attackers to access data across multiple user profiles. This could potentially lead to unauthorized access to sensitive information.

Recommendations For Samsung Message versions prior to SMR Jan-2025 Release 1, update to SMR Jan-2025 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting physical access to devices with multiple user profiles to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2025-20884

Affected Products

Samsung Message

References · 7

• https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20884 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20884 · Vendor Advisory
• https://t.me/cvenotify/111040 · Telegram Post
• https://t.me/cvenotify/109819 · Telegram Post
• https://t.me/cvedetector/17175 · Telegram Post
• https://twitter.com/CVEnew/status/1886680235766374808 · Twitter Post