ACTIVELY EXPLOITED
CVE-2021-25489: Samsung Mobile Devices Improper Input Validation Vulnerability
| Vendor | Samsung |
|---|---|
| Product | Mobile Devices |
| Actively exploited | Yes |
| Added to CISA KEV | 29 Jun 2023 |
| CISA federal deadline | 20 Jul 2023 |
| Weakness (CWE) | CWE-20 |
Required action (CISA's text)
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Description (NVD)
Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.
SOURCES
Other Samsung flaws
- CVE-2024-7399: Samsung MagicINFO 9 Server Path Traversal Vulnerability
- CVE-2025-21042: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
- CVE-2025-21043: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
- CVE-2025-4632: Samsung MagicINFO 9 Server Path Traversal Vulnerability
- CVE-2022-22265: Samsung Mobile Devices Use-After-Free Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.