CVE-2021-25426

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper component protection vulnerability in SmsViewerActivity of Samsung Message prior to SMR July-2021 Release 1 allows untrusted applications to access Message files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Mobile Devices	>= P(9.0), Q(10.0) , R(11.0), < SMR July-2021 Release 1

References

https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/Exploit, Third Party Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=7Vendor Advisory
https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/Exploit, Third Party Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=7Vendor Advisory

Timeline

Published: Jul 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-254276.5SQL injection vulnerability in Bluetooth prior to SMR July-2021 Release 1 allows unauthorized access to paired device information CVE-2021-254287.8Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous le CVE-2021-254294.3Improper privilege management vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access CVE-2021-254304.3Improper access control vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the B CVE-2021-254315.5Improper access control vulnerability in Cameralyzer prior to versions 3.2.1041 in 3.2.x, 3.3.1040 in 3.3.x, and 3.4.4210 in 3.4.x allows un CVE-2021-254323.3Information exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.CVE-2021-254335.5Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications t CVE-2021-254349.8Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using CVE-2021-254359.8Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using CVE-2021-254369.8Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via CVE-2021-254379.8Improper access control vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows attackers to arbitrary code exe CVE-2021-254387.8Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P