CVE-2025-21028

MediumCVSS 5.5/10Last modified Sep 30, 2026

Description

Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Sep 3, 2025
Last modified
Sep 30, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-210293.3Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies tCVE-2025-21038.8The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a mCVE-2025-210304.3Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese Android 15 allows locaCVE-2025-210316.8Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs.CVE-2025-210326.8Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited conditioCVE-2025-210335.5Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information.CVE-2025-210347.8Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code.CVE-2025-210354.6Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers CVE-2025-210365.0Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. User inCVE-2025-210374.3Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. CVE-2025-210383.3Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modifCVE-2025-210393.3Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify
CVE-2025-21028: Medium severity, CVSS 5.5 | Vulnix