CVE-2021-25374

State: Published
Severity: 8.6 High
Published: Apr 9, 2021
Updated: Aug 3, 2024
Reserved: Jan 19, 2021

Description

An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 in Android P(9.0) and above allows remote attackers to access a user data related with Samsung Account.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	Samsung Mobile

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
Samsung MembersSamsung Mobile	Android O(8.x) and below to before 2.4.83.9Affected Android P(9.0) and above to before 3.9.00.9Affected

References

https://security.samsungmobile.com/
https://security.samsungmobile.com/serviceWeb.smsb

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.