CVE-2021-25337
KEVSamsung Mobile Devices Improper Access Control Vulnerability
Description
Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NPublishedMar 4, 2021
Last modifiedJun 17, 2026
Added to KEVNov 8, 2022
Remediation dueNov 29, 2022
References
- security.samsungmobile.comVendor Advisory
- security.samsungmobile.com/securityUpdate.smsbVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25337US Government Resource
0 recent articles mention this CVE
52
Risk assessment · Medium
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1427 days
- CVSS
- 4.4 MEDIUM
- EPSS (30-day exploit probability)
- 2.8% · top 14% of all CVEs
- Weakness
- CWE-269
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.