CVE-2021-25337

HighCVSS 7.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Mobile Devices	>= Selected P(9.0), Q(10.0), R(11.0), < SMR Mar-2021 Release 1

References

https://security.samsungmobile.comVendor Advisory
https://security.samsungmobile.com/securityUpdate.smsbVendor Advisory
https://security.samsungmobile.comVendor Advisory
https://security.samsungmobile.com/securityUpdate.smsbVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25337US Government Resource

Timeline

Published: Mar 4, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 8, 2022
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-253385.2Improper memory access control in RKP in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kern CVE-2021-253395.2Improper address validation in HArx in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows an attacker, given a compromised kernel CVE-2021-253402.4Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to c CVE-2021-253413.3Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack by CVE-2021-253423.3Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacki CVE-2021-253433.3Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0 CVE-2021-253445.5Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number wi CVE-2021-253455.5Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupport CVE-2021-253469.8A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code executio CVE-2021-253475.3Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider CVE-2021-253482.4Improper permission grant check in Samsung Internet prior to version 13.0.1.60 allows access to files in internal storage without authorized CVE-2021-253497.8Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via