CVE-2021-25397 — Improper Export of Android Application Components in Mobile Devices

CWE-926 — Improper Export of Android Application Components CWE-863 — Incorrect Authorization3 documents3 sources

Severity

5.5MEDIUMNVD

CNA6.8

EPSS

0.0%

top 94.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Samsung Mobile Devices Google Android

Timeline

PublishedJun 11

Latest updateMay 24

Description

An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of telephony process via untrusted applications.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5samsung_mobile/samsung_mobile_devicesP(9.0), Q(10.0), R(11.0) — SMR MAY-2021 Release 1

▶NVDgoogle/android10.0, 11.0, 9.0+2

🔴Vulnerability Details

GHSA

GHSA-gg2x-4f8g-8499: An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of telephony p↗2022-05-24

▶

CVEList

CVE-2021-25397: An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of telephony p↗2021-06-11

▶