CVE-2021-25489

LOW3.3

CISA KEV

Published 2021-10-06 · Updated 2026-06-17 · Source mobile.security@samsung.com

Summary

CVE-2021-25489 is a low-severity (CVSS 3.3) vulnerability in Samsung Mobile Devices. CISA added it to the Known Exploited Vulnerabilities catalog on June 29, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 20, 2023. CISA does not currently list it as used in ransomware campaigns. Samsung has 15 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 15 known-exploited Samsung vulnerabilities →

Description

Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-20CWE-134

CISA Known-Exploited Vulnerability

Product: Samsung — Mobile Devices

Name: Samsung Mobile Devices Improper Input Validation Vulnerability

Date added: 2023-06-29 · Due: 2023-07-20

Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

References

View on NVD

More exploited Samsung vulnerabilities

Most recently added to CISA KEV

CVE-2024-7399
MagicINFO 9 Server — Samsung MagicINFO 9 Server Path Traversal Vulnerability
added 2026-04-24
CVE-2025-21042
Mobile Devices — Samsung Mobile Devices Out-of-Bounds Write Vulnerability
added 2025-11-10
CVE-2025-21043
Mobile Devices — Samsung Mobile Devices Out-of-Bounds Write Vulnerability
added 2025-10-02
CVE-2025-4632
MagicINFO 9 Server — Samsung MagicINFO 9 Server Path Traversal Vulnerability
added 2025-05-22
CVE-2022-22265
Mobile Devices — Samsung Mobile Devices Use-After-Free Vulnerability
added 2023-09-18
CVE-2021-25487
Mobile Devices — Samsung Mobile Devices Out-of-Bounds Read Vulnerability
added 2023-06-29

View all →

Related CVEs

Same severity, most recent

CVE-2026-111602
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name, last name, email address, phone number, and notes of every customer record in the database by enumerating uuid prefixes via the unauthenticated steps__load_step AJAX endpoint. This vulnerability is only exploitable when the LatePoint plugin is configured with the 'Field used for authentication' setting set to 'Disable ability to login' (guest checkout mode).
2026-10-17 · score 3.7
CVE-2026-17591
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
2026-10-16 · score 3.6
CVE-2026-17275
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
2026-10-16 · score 3.7
CVE-2026-111714
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
2026-10-16 · score 3.1
CVE-2026-111678
Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing.
2026-10-16 · score 3.3