CVE-2022-1230

LowCVSS 3.9/10Last modified Jun 17, 2026

Description

This vulnerability allows local attackers to execute arbitrary code on affected installations of Samsung Galaxy S21 prior to 4.5.40.5 phones. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of redirections. An attacker can force a redirection to a site that serves malicious content. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the current user. Was ZDI-CAN-15918.

Metrics

CVSS 3.1 3.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
SamsungGalaxy S21prior to 4.5.40.5

References

Timeline

Published
Mar 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-12316.1XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagraCVE-2022-12328.8Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2022-12336.1URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.CVE-2022-12346.1XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websiCVE-2022-12358.2Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.CVE-2022-12366.5Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.CVE-2022-12377.8Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be expCVE-2022-12387.8Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow anCVE-2022-12398.8The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with thCVE-2022-12407.8Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disableCVE-2022-12416.1The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to RefCVE-2022-12427.8Apport can be tricked into connecting to arbitrary sockets as the root user
CVE-2022-1230: Low severity, CVSS 3.9 | Vulnix