CVE-2021-25369 is an improper access control vulnerability in Samsung Android devices, specifically affecting the 'sec_log' file prior to the SMR MAR-2021 Release 1. This flaw allows sensitive kernel information to be exposed to userspace. With a CVSS score of 5.5 (Medium), it can be exploited locally with low attack complexity, leading to high confidentiality impact without affecting integrity or availability. This vulnerability is actively exploited (KEV listed) and has garnered significant community discussion, though no public exploit code is currently available on platforms like Metasploit or ExploitDB.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
8.0CPE matchmatch criteria | cpe:2.3:o:samsung:android:8.0:-:*:*:*:*:*:* | ||
8.1CPE matchmatch criteria | cpe:2.3:o:samsung:android:8.1:-:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:samsung:android:9.0:smr-apr-2019-r1:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:samsung:android:9.0:smr-apr-2020-r1:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:samsung:android:9.0:smr-aug-2019-r1:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.