CVE-2021-25331

LowCVSS 2.4/10Last modified Jun 17, 2026

Description

Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen in specific condition.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Pay Mini	>= unspecified, < 4.0.14

References

https://security.samsungmobile.comVendor Advisory
https://security.samsungmobile.com/serviceWeb.smsbVendor Advisory
https://security.samsungmobile.comVendor Advisory
https://security.samsungmobile.com/serviceWeb.smsbVendor Advisory

Timeline

Published: Mar 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-253322.4Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts information over the lockscr CVE-2021-253332.4Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscre CVE-2021-253345.5Improper input check in wallpaper service in Samsung mobile devices prior to SMR Feb-2021 Release 1 allows untrusted application to cause pe CVE-2021-253352.5Improper lockscreen status check in cocktailbar service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows unauthenticated use CVE-2021-253363.3Improper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted application CVE-2021-253377.1Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read CVE-2021-253385.2Improper memory access control in RKP in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kern CVE-2021-253395.2Improper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel CVE-2021-253402.4Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to c CVE-2021-253413.3Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack by CVE-2021-253423.3Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacki CVE-2021-253433.3Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0