CVE-2021-25414

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to copy or overwrite arbitrary files with Samsung Contacts privilege.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Mobile Devices	>= P(9.0), Q(10.0), R(11.0), < SMA JUN-2021 Release 1

References

https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/Exploit, Third Party Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6Vendor Advisory
https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/Exploit, Third Party Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6Vendor Advisory

Timeline

Published: Jun 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-254155.5Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memor CVE-2021-254166.5Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executab CVE-2021-254177.5Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage.CVE-2021-254187.8Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrar CVE-2021-254196.5Non-compliance of recommended secure coding scheme in Samsung Internet prior to version 14.0.1.62 allows attackers to display fake URL in ad CVE-2021-254205.5Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak W CVE-2021-254215.5Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak CVE-2021-254225.5Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak W CVE-2021-254235.5Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak CVE-2021-254248.8Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take ov CVE-2021-254255.3Improper check vulnerability in Samsung Health prior to version 6.17 allows attacker to read internal cache data via exported component.CVE-2021-254267.5Improper component protection vulnerability in SmsViewerActivity of Samsung Message prior to SMR July-2021 Release 1 allows untrusted applic