CVE-2025-21028
published 2025-09-03CVE-2025-21028: Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items.
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNIHAN
EPSS
0.11%
1.2th percentile
Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| samsung | android | — | — |
| samsung | android | — | — |
| samsung | android | — | — |
| samsung | android | — | — |
| samsung | android | — | — |
| samsung | android | — | — |
| samsung | android | — | — |
| samsung | android | — | — |
| samsung | android | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Samsung Devices ThemeManager privileges management (WID-SEC-2025-1943)
vuldb·2026-10-02·CVSS 5.5
CVE-2025-21028 [MEDIUM] Samsung Devices ThemeManager privileges management (WID-SEC-2025-1943)
A vulnerability was found in Samsung Devices and classified as critical. This impacts an unknown function of the component ThemeManager. Such manipulation leads to improper privilege management.
This vulnerability is listed as CVE-2025-21028. The attack must be carried out locally. There is no available exploit.
A patch should be applied to remediate this issue.
GHSA
GHSA-89xc-2rc9-gcgc: Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items
ghsa_unreviewed·2025-09-11
CVE-2025-21028 [MEDIUM] GHSA-89xc-2rc9-gcgc: Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items
Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-03
Published