Samsung Android vulnerabilities

CVE-2024-34640 [LOW] CVE-2024-34640: Improper access control vulnerability in BGProtectManager prior to SMR Sep-2024 Release 1 allows loc Improper access control vulnerability in BGProtectManager prior to SMR Sep-2024 Release 1 allows local attackers to bypass restriction of process expiration.

CVE-2024-34650 [LOW] CWE-863 CVE-2024-34650: Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel.

CVE-2024-34652 [LOW] CWE-863 CVE-2024-34652: Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information related to performance including app usage.

CVE-2025-20960 [LOW] CVE-2025-20960: Improper handling of insufficient permission in CocktailBarService prior to SMR May-2025 Release 1 a Improper handling of insufficient permission in CocktailBarService prior to SMR May-2025 Release 1 allows local attackers to use the privileged api.

CVE-2023-21469 [LOW] CVE-2023-21469: Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local atta Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung.android.wifi.GEOFENCE action.

CVE-2023-21470 [LOW] CVE-2023-21470: Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local atta Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung.android.wifi.NETWORK_LOCATION action.

CVE-2025-20985 [LOW] CVE-2025-20985: Improper privilege management in ThemeManager prior to SMR Jun-2025 Release 1 allows local privilege Improper privilege management in ThemeManager prior to SMR Jun-2025 Release 1 allows local privileged attackers to reuse trial items.

CVE-2026-20992 [LOW] CWE-863 CVE-2026-20992: Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application.

CVE-2026-21027 [LOW] CVE-2026-21027: Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 all Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function.

CVE-2023-21512 [LOW] CWE-269 CVE-2023-21512: Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows l Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access permission.

CVE-2023-30717 [LOW] CVE-2023-30717: Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows atta Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to get unresettable identifiers.

CVE-2023-30685 [LOW] CVE-2023-30685: Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakc Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakcers to change TTY mode.

CVE-2023-30718 [LOW] CVE-2023-30718: Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1 allows local attacker to change a Auto Hotspot setting.

CVE-2023-30700 [LOW] CVE-2023-30700: PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Rel PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local attackers to access ContentProvider without proper permission.

CVE-2024-20860 [LOW] CVE-2024-20860: Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reboot the device without proper permission.

CVE-2023-30640 [LOW] CVE-2023-30640: Improper access control vulnerability in PersonaManagerService prior to SMR Jul-2023 Release 1 allow Improper access control vulnerability in PersonaManagerService prior to SMR Jul-2023 Release 1 allows local attackers to change confiugration.

CVE-2023-21487 [LOW] CWE-287 CVE-2023-21487: Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting.

CVE-2024-34677 [LOW] CWE-922 CVE-2024-34677: Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate.

CVE-2024-20847 [LOW] CVE-2024-20847: Improper Access Control vulnerability in StorageManagerService prior to SMR Apr-2024 Release 1 allow Improper Access Control vulnerability in StorageManagerService prior to SMR Apr-2024 Release 1 allows local attackers to read sdcard information.

CVE-2024-34641 [LOW] CVE-2024-34641: Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allo Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allows local attackers to enable NFC configuration.