ACTIVELY EXPLOITED
CVE-2021-25337: Samsung Mobile Devices Improper Access Control Vulnerability
| Vendor | Samsung |
|---|---|
| Product | Mobile Devices |
| Actively exploited | Yes |
| Added to CISA KEV | 8 Nov 2022 |
| CISA federal deadline | 29 Nov 2022 |
| Weakness (CWE) | CWE-269 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.
SOURCES
Other Samsung flaws
- CVE-2024-7399: Samsung MagicINFO 9 Server Path Traversal Vulnerability
- CVE-2025-21042: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
- CVE-2025-21043: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
- CVE-2025-4632: Samsung MagicINFO 9 Server Path Traversal Vulnerability
- CVE-2022-22265: Samsung Mobile Devices Use-After-Free Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.