CVE-2021-25377

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attacker to execute privileged action.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-269

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Experience Service	>= Android P(9.0) below, < 10.8.0.4; >= Android Q(10.0) above, < 12.2.0.5

References

https://security.samsungmobile.com/Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsbVendor Advisory
https://security.samsungmobile.com/Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsbVendor Advisory

Timeline

Published: Apr 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-253785.3Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service.CVE-2021-253793.3Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.CVE-2021-253807.3Improper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the use CVE-2021-253817.8Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above al CVE-2021-253825.5An improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020 Release 1 allows unauthorized access to contents CVE-2021-253839.8An improper input validation vulnerability in scmn_mfal_read() in libsapeextractor library prior to SMR MAY-2021 Release 1 allows attackers CVE-2021-253849.8An improper input validation vulnerability in sdfffd_parse_chunk_PROP() with Sample Rate Chunk in libsdffextractor library prior to SMR MAY-CVE-2021-253859.8An improper input validation vulnerability in sdfffd_parse_chunk_PROP() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows a CVE-2021-253869.8An improper input validation vulnerability in sdfffd_parse_chunk_FVER() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows a CVE-2021-2538710.0An improper input validation vulnerability in sflacfd_get_frm() in libsflacextractor library prior to SMR MAY-2021 Release 1 allows attacker CVE-2021-253887.1Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app.CVE-2021-253896.1Improper running task check in S Secure prior to SMR MAY-2021 Release 1 allows attackers to use locked app without authentication.