Skip to content
Fencer Vulns
medium 4.4

CVE-2021-25337 kev in the critical feed json

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to rea…

published 2021-03-04 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-12233

cvss
4.4
version 3.1, CNA
cisa kev
Exploited
added 2022-11-08
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • Samsung Mobile Samsung Mobile Devices SMR Mar-2021 Release 1

Timeline

  1. Found exploited as a 0-day (Project Zero)
  2. 0-day patched (Project Zero)
  3. Published
  4. Added to CISA KEV
  5. CISA patch deadline
  6. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-11-29 (3 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Samsung, Mobile Devices
CISA name
Samsung Mobile Devices Improper Access Control Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Found
2020-11-03
Patched
2021-03-01
Details
project zero root cause analysis

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

2.81% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

  • Samsung Mobile Samsung Mobile Devices

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.