Improper Permission Handling in Samsung SpenGesture Service
CVE-2025-20962

4MEDIUM

Key Information:

Vendor

Samsung
Status
Samsung Devices
Vendor
CVE Published:
7 May 2025

What is CVE-2025-20962?

The SpenGesture service from Samsung exhibits improper handling of insufficient permissions prior to the SMR May-2025 Release 1, enabling local attackers to potentially monitor S Pen movements without authorization. This can lead to serious privacy concerns as sensitive activities may be tracked by unauthorized users.

Affected Version(s)

Samsung Mobile Devices SMR May-2025 Release in Android 13, 14, 15

References

https://security.samsungmobile.com/securityUpdate.smsb?ye...

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.