{"id":"CVE-2025-21076","state":"PUBLISHED","title":"Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access data in Samsung Account. User interactio","description":"Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access data in Samsung Account. User interaction is required for triggering this vulnerability.","publishedAt":"2025-11-05T05:40:57.790Z","updatedAt":"2025-11-07T14:26:14.798Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","source":"SamsungMobile"},"assigner":"SamsungMobile","products":["Samsung Mobile Samsung Account"],"affected":[{"vendor":"Samsung Mobile","product":"Samsung Account","defaultStatus":"affected","versions":[{"version":"15.5.00.18","status":"unaffected"}]}],"references":["https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=11"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/21xxx/CVE-2025-21076.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21076","state":"PUBLISHED","datePublished":"2025-11-05T05:40:57.790Z","dateUpdated":"2025-11-07T14:26:14.798Z","assignerShortName":"SamsungMobile","assignerOrgId":"3af57064-a867-422c-b2ad-40307b65c458","dateReserved":"2024-11-06T02:30:14.896Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access data in Samsung Account. User interaction is required for triggering this vulnerability."}],"affected":[{"vendor":"Samsung Mobile","product":"Samsung Account","defaultStatus":"affected","versions":[{"version":"15.5.00.18","status":"unaffected"}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=11"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":5.5,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-280: Improper Handling of Insufficient Permissions or Privileges"}]}],"providerMetadata":{"shortName":"SamsungMobile","orgId":"3af57064-a867-422c-b2ad-40307b65c458","dateUpdated":"2025-11-05T05:40:57.790Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-11-05T14:14:18.179248Z","id":"CVE-2025-21076","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-11-07T14:26:14.798Z"}}]}}}