CVE-2024-20821

A vulnerability possible to reconfigure OTP allows local attackers to transit RMA(Return Merchandise Authorization) mode, which disables security features. This attack needs additional privilege to control TEE.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=05
https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=05

Configurations

No configuration.

History

No history.

Information

Published : 2024-05-07 05:15

Updated : 2026-06-17 07:07

NVD link : CVE-2024-20821

Mitre link : CVE-2024-20821

CVE.ORG link : CVE-2024-20821

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2024-20821", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-20821", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-07T14:49:29.528472Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "mobile.security@samsung.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "affected": [{"source": "mobile.security@samsung.com", "affectedData": [{"vendor": "Samsung Mobile", "product": "Samsung Mobile Devices", "versions": [{"status": "unaffected", "version": "Galaxy S24"}], "defaultStatus": "affected"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:h:samsung:exynos_1380:-:*:*:*:*:*:*:*"], "vendor": "samsung", "product": "exynos_1380", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:samsung:exynos_1330:-:*:*:*:*:*:*:*"], "vendor": "samsung", "product": "exynos_1330", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:samsung:exynos2400:-:*:*:*:*:*:*:*"], "vendor": "samsung", "product": "exynos2400", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}]}], "published": "2024-05-07T05:15:48.790", "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=05", "source": "mobile.security@samsung.com"}, {"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=05", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "A vulnerability possible to reconfigure OTP allows local attackers to transit RMA(Return Merchandise Authorization) mode, which disables security features. This attack needs additional privilege to control TEE."}, {"lang": "es", "value": "Una vulnerabilidad posible para reconfigurar OTP permite a atacantes locales transitar el modo RMA (Autorizaci\u00f3n de devoluci\u00f3n de mercanc\u00eda), que desactiva las funciones de seguridad. Este ataque necesita privilegios adicionales para controlar TEE."}], "lastModified": "2026-06-17T07:07:57.497", "sourceIdentifier": "mobile.security@samsung.com"}