Flow
Vendor:
First CVE: Feb 9, 2023 · Active for 3 years
6
Total CVEs
More Total CVEs than 80% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
6.1
Avg CVSS
Higher Avg CVSS than 21% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Flow over time
Volume of CVEsAvg CVSS Base Score
First CVE
Feb 9, 2023
3 years ago
Most Recent CVE
May 7, 2025
443 days ago
CVE Severity & Scoring
Flow6 CVEs
17%
50%
33%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local3 (50.0%)
Network0 (0.0%)
Unknown0 (0.0%)
Physical1 (16.7%)
Adjacent Network2 (33.3%)
Attack Complexity
Low6 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low3 (50.0%)
High0 (0.0%)
None3 (50.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-21443HIGH Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to decrypt encrypted messages or inject commands. | Feb 9, 2023 | 8.8 | 26 | NO | NO |
CVE-2023-21444HIGH Improper cryptographic implementation in Samsung Flow for PC 4.9.14.0 allows adjacent attackers to decrypt encrypted messages or inject commands. | Feb 9, 2023 | 8.8 | 21 | NO | NO |
CVE-2025-20972MEDIUM Improper verification of intent by broadcast receiver in Samsung Flow prior to version 4.9.17.6 allows local attackers to modify Samsung Flow configuration. | May 7, 2025 | 5.5 | 17 | NO | NO |
CVE-2025-20971MEDIUM Improper input validation in Samsung Flow prior to version 4.9.17.6 allows local attackers to access data within Samsung Flow. | May 7, 2025 | 5.5 | 17 | NO | NO |
CVE-2024-49407MEDIUM Improper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to access data across multiple user profiles. | Nov 6, 2024 | 4.6 | 16 | NO | NO |
Improper verification of intent by broadcast receiver vulnerability in Samsung Flow prior to version 4.9.13.0 allows local attackers to copy image files to external storage. | Jul 2, 2024 | 3.3 | 13 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (6 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (6 CVEs).
Media Mentions
Signals from CVEs in this product scope (6 CVEs).
Top CNAs Publishing CVEs For Flow
Top CWEs
Versions
No cataloged versions.