CVE-2021-25374

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 in Android P(9.0) and above allows remote attackers to access a user data related with Samsung Account.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-285

Affected software

VendorProductVersions
Samsung MobileSamsung Members>= Android O(8.x) and below, < 2.4.83.9; >= Android P(9.0) and above, < 3.9.00.9

References

Timeline

Published
Apr 9, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-253756.5Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emaCVE-2021-253765.3An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLCVE-2021-253777.8Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attCVE-2021-253785.3Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service.CVE-2021-253793.3Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.CVE-2021-253807.3Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the useCVE-2021-253817.8Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above alCVE-2021-253825.5An improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020 Release 1 allows unauthorized access to contentsCVE-2021-253839.8An improper input validation vulnerability in scmn_mfal_read() in libsapeextractor library prior to SMR MAY-2021 Release 1 allows attackers CVE-2021-253849.8An improper input validation vulnerability in sdfffd_parse_chunk_PROP() with Sample Rate Chunk in libsdffextractor library prior to SMR MAY-CVE-2021-253859.8An improper input validation vulnerability in sdfffd_parse_chunk_PROP() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows aCVE-2021-253869.8An improper input validation vulnerability in sdfffd_parse_chunk_FVER() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows a