CVE-2021-25343

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0) and above) allows unauthorized actions including denial of service attack by hijacking the provider.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Members	>= Android O(8.1) and below, < 2.4.81.13; >= Android P(9.0) and above, < 3.8.00.13

References

https://security.samsungmobile.com/Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsbVendor Advisory
https://security.samsungmobile.com/Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsbVendor Advisory

Timeline

Published: Mar 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-253445.5Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number wi CVE-2021-253455.5Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupport CVE-2021-253469.8A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code executio CVE-2021-253475.3Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider CVE-2021-253482.4Improper permission grant check in Samsung Internet prior to version 13.0.1.60 allows access to files in internal storage without authorized CVE-2021-253497.8Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via CVE-2021-253503.9Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user informa CVE-2021-253512.4Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attacke CVE-2021-253527.8Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijackin CVE-2021-253537.1Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Gal CVE-2021-253545.3Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via CVE-2021-253557.8Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hij