Authentication Bypass Vulnerability in Galaxy Store by Samsung
CVE-2025-20895

4.6MEDIUM

Key Information:

Vendor

Samsung
Status
Galaxy Store
Vendor
CVE Published:
4 February 2025

What is CVE-2025-20895?

An authentication bypass vulnerability exists in the Galaxy Store prior to version 4.5.87.6, enabling physical attackers to exploit the Setupwizard. This flaw permits the installation of arbitrary applications, circumventing established restrictions and potentially leading to unauthorized access and installation of malicious software.

Affected Version(s)

Galaxy Store 4.5.87.6

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2...

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.