CVE-2022-36876: Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication.

PriorityP48low2.4CVSS 3.1

AVPACLPRNUINSUCLINAN

EPSS

0.32%

24.4th percentile

Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
samsung	samsung_pass	< 4.0.04.10	4.0.04.10
samsung_mobile	samsung_pass	>= unspecified < 4.0.04.10	4.0.04.10

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.