Improper Access Control in Samsung Account Prior to Version 10.7.0.7
CVE-2021-25351

3.2LOW

Key Information:

Vendor
Samsung
Status
Samsung Account
Vendor
CVE Published:
25 March 2021

Summary

The improper access control vulnerability in the Samsung Account application allows physically proximate attackers to log out user accounts without needing the user's password. This issue affects versions of the Samsung Account prior to 10.7.0.7 and 12.1.1.3, posing a risk to user account security. Attackers can exploit this flaw to disrupt user sessions, potentially leading to unauthorized access and privacy breaches. It underscores the importance of robust access controls in safeguarding user credentials against unauthorized actions.

Affected Version(s)

Samsung Account Android P(9.0) and below < 10.7.07

Samsung Account Android Q(10.0) < 12.1.1.3

References

https://security.samsungmobile.com/
x_refsource_MISC
https://security.samsungmobile.com/serviceWeb.smsb
x_refsource_MISC

CVSS V3.1

Score:
3.2
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.