CVE-2025-21029

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the cover display.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-21038.8The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a m CVE-2025-210304.3Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese Android 15 allows loca CVE-2025-210316.8Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs.CVE-2025-210326.8Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited conditio CVE-2025-210335.5Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information.CVE-2025-210347.8Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code.CVE-2025-210354.6Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers CVE-2025-210365.0Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. User in CVE-2025-210374.3Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. CVE-2025-210383.3Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modif CVE-2025-210393.3Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify CVE-2025-21044.3The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insuf