Samsung Android vulnerabilities

CVE-2024-49422 [LOW] CVE-2024-49422: Protection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical attackers Protection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical attackers to reset lockscreen failure count by hardware fault injection. User interaction is required for triggering this vulnerability.

CVE-2023-42570 [LOW] CVE-2023-42570: Improper access control vulnerability in KnoxCustomManagerService prior to SMR Dec-2023 Release 1 al Improper access control vulnerability in KnoxCustomManagerService prior to SMR Dec-2023 Release 1 allows attacker to access device SIM PIN.

CVE-2023-21429 [LOW] CWE-285 CVE-2023-21429: Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access S Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.

CVE-2023-30667 [LOW] CVE-2023-30667: Improper access control in Audio system service prior to SMR Jul-2023 Release 1 allows attacker to s Improper access control in Audio system service prior to SMR Jul-2023 Release 1 allows attacker to send broadcast with system privilege.

CVE-2023-21424 [LOW] CWE-285 CVE-2023-21424: Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prio Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify network related values, network code, carrier id and operator brand.

CVE-2024-20900 [LOW] CWE-287 CVE-2024-20900: Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication.

CVE-2025-20990 [LOW] CVE-2025-20990: Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to access device identifier.

CVE-2024-49414 [LOW] CVE-2024-49414: Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows phy Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list.

CVE-2023-42569 [LOW] CWE-863 CVE-2023-42569: Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR Emoji.

CVE-2023-21428 [LOW] CWE-20 CVE-2023-21428: Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attack Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call. The patch removes unused code.

CVE-2023-30732 [LOW] CVE-2023-30732: Improper access control in system property prior to SMR Oct-2023 Release 1 allows local attacker to Improper access control in system property prior to SMR Oct-2023 Release 1 allows local attacker to get CPU serial number.

CVE-2023-30715 [LOW] CVE-2023-30715: Improper access control vulnerability in Weather prior to SMR Sep-2023 Release 1 allows attackers to Improper access control vulnerability in Weather prior to SMR Sep-2023 Release 1 allows attackers to access location information set in Weather without permission.

CVE-2023-21458 [LOW] CWE-269 CVE-2023-21458: Improper privilege management vulnerability in PhoneStatusBarPolicy in System UI prior to SMR Mar-20 Improper privilege management vulnerability in PhoneStatusBarPolicy in System UI prior to SMR Mar-2023 Release 1 allows attacker to turn off Do not disturb via unprotected intent.

CVE-2023-21452 [LOW] CWE-285 CVE-2023-21452: Improper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to ge Improper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to get MAC address of connected device.

CVE-2023-21436 [LOW] CWE-285 CVE-2023-21436: Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID.

CVE-2024-20872 [LOW] CVE-2024-20872: Improper handling of insufficient privileges vulnerability in TalkbackSE prior to version Android 14 Improper handling of insufficient privileges vulnerability in TalkbackSE prior to version Android 14 allows local attackers to modify setting value of TalkbackSE.

CVE-2025-20941 [LOW] CVE-2025-20941: Improper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to access t Improper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to access the scancode of specific input device.

CVE-2023-30682 [LOW] CVE-2023-30682: Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call si Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call silenceRinger API without permission.

CVE-2023-30683 [LOW] CVE-2023-30683: Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call en Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call endCall API without permission.

CVE-2023-30684 [LOW] CVE-2023-30684: Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRingingCall API without permission.