{"id":"CVE-2025-20970","state":"PUBLISHED","title":"Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attackers to access image files with Bixby Visi","description":"Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attackers to access image files with Bixby Vision privilege.","publishedAt":"2025-05-07T08:24:25.907Z","updatedAt":"2025-05-07T15:48:44.098Z","severity":{"score":6.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"SamsungMobile"},"assigner":"SamsungMobile","products":["Samsung Mobile Bixby Vision"],"affected":[{"vendor":"Samsung Mobile","product":"Bixby Vision","defaultStatus":"affected","versions":[{"version":"3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15","status":"unaffected"}]}],"references":["https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/20xxx/CVE-2025-20970.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-20970","state":"PUBLISHED","datePublished":"2025-05-07T08:24:25.907Z","dateUpdated":"2025-05-07T15:48:44.098Z","assignerShortName":"SamsungMobile","assignerOrgId":"3af57064-a867-422c-b2ad-40307b65c458","dateReserved":"2024-11-06T02:30:14.867Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attackers to access image files with Bixby Vision privilege."}],"affected":[{"vendor":"Samsung Mobile","product":"Bixby Vision","defaultStatus":"affected","versions":[{"version":"3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15","status":"unaffected"}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=05"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":6.2,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"shortName":"SamsungMobile","orgId":"3af57064-a867-422c-b2ad-40307b65c458","dateUpdated":"2025-05-07T08:24:25.907Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-07T15:48:30.356963Z","id":"CVE-2025-20970","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-07T15:48:44.098Z"}}]}}}