CVE-2021-25395

MediumCVSS 6.4/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Mobile Devices	>= O(8.x), P(9.0), Q(10.0), R(11.0), < SMR MAY-2021 Release 1

References

https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5Vendor Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25395US Government Resource

Timeline

Published: Jun 11, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Jun 29, 2023
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-253966.7An improper input validation vulnerability in NPU firmware prior to SMR MAY-2021 Release 1 allows arbitrary memory write and code execution.CVE-2021-253975.5An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of t CVE-2021-253983.3Intent redirection vulnerability in Bixby Voice prior to version 3.1.12 allows attacker to access contacts.CVE-2021-253997.1Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege.CVE-2021-254007.8Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action.CVE-2021-254017.8Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action.CVE-2021-254023.3Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information.CVE-2021-254033.3Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) a CVE-2021-254043.3Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log.CVE-2021-254055.5An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to a CVE-2021-254066.5Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT d CVE-2021-254077.8A possible out of bounds write vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write.