An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.

cisa required action Apply updates per vendor instructions.

1. 2020-12-10 Found exploited as a 0-day (Project Zero)
2. 2021-03-01 0-day patched (Project Zero)
3. 2021-03-26 Published
4. 2022-11-08 Added to CISA KEV
5. 2022-11-29 CISA patch deadline
6. 2025-02-04 CISA SSVC: exploitation active

Added

4 y ago (2022-11-08)

Patch by

2022-11-29 (3 y ago)

Ransomware

Not known

Required action

Apply updates per vendor instructions.

Vendor, product

Samsung, Mobile Devices

CISA name

Samsung Mobile Devices Improper Access Control Vulnerability

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Found

2020-12-10

Patched

2021-03-01

Details

project zero root cause analysis

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

partial

Assessed

21 mo ago (2025-02-04)

1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Samsung Mobile Samsung Mobile Devices

Weakness

• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

• security.samsungmobile.com /securityUpdate.smsb

  vendor-advisory

• security.samsungmobile.com

  vendor-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25369

  government-resource, us-government-resource

• CVE List CVE-2021-25369
• NVD CVE-2021-25369

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.