CVE-2022-25831

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Improper access control vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to access secured data in certain conditions.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Samsung Mobile	Samsung Mobile Devices	>= Select Q(10), R(11), S(12) devices, < SMR Apr-2022 Release 1

References

https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4Third Party Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4Third Party Advisory

Timeline

Published: Apr 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-258326.8Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app withou CVE-2022-258333.3Improper authentication in ImsService prior to SMR Apr-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permi CVE-2022-258347.8In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected c CVE-2022-258367.5Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials wi CVE-2022-258377.5Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pai CVE-2022-258388.1Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.CVE-2022-258395.3The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the host CVE-2022-25847.5The dag-pb codec can panic when decoding invalid blocks.CVE-2022-258417.8Uncontrolled search path elements in the Intel(R) Datacenter Group Event Android application, all versions, may allow an authenticated user CVE-2022-258429.8All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2022-258447.5The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes CVE-2022-258459.8The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdow