CVE-2023-42571

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the Samsung Account password with SMS verification when user lost the device.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Dec 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-425725.5Implicit intent hijacking vulnerability in Samsung Account Web SDK prior to version 1.5.24 allows attacker to get sensitive information.CVE-2023-425735.5PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data.CVE-2023-425747.8Improper access control vulnerablility in GameHomeCN prior to version 4.2.60.2 allows local attackers to launch arbitrary activity in GameHo CVE-2023-425756.8Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to i CVE-2023-425766.8Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to i CVE-2023-425772.4Improper Access Control in Samsung Voice Recorder prior to versions 21.4.15.01 in Android 12 and Android 13, 21.4.50.17 in Android 14 allows CVE-2023-425787.5Improper handling of insufficient permissions or privileges vulnerability in Samsung Data Store prior to version 5.2.00.7 allows remote atta CVE-2023-425795.3Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49,CVE-2023-42586.5In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be a CVE-2023-425809.8Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to inst CVE-2023-425817.5Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to ac CVE-2023-42598.8Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.