CVE-2025-21037

Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is required for triggering this vulnerability.

CVSS v3 4.1 MEDIUM

4.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:samsung:notes:*:*:*:*:*:*:*:*

History

01 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Control de acceso inadecuado en Samsung Notes anterior a la versión 4.4.30.63 permite a atacantes físicos acceder a datos en múltiples perfiles de usuario. Se requiere interacción del usuario para activar esta vulnerabilidad.

Information

Published : 2025-09-03 06:15

Updated : 2026-10-01 16:10

NVD link : CVE-2025-21037

Mitre link : CVE-2025-21037

CVE.ORG link : CVE-2025-21037

JSON object : View

Products Affected

samsung

notes

CWE

NVD-CWE-noinfo

{"id": "CVE-2025-21037", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21037", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-03T15:10:24.106635Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "mobile.security@samsung.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.7}]}, "affected": [{"source": "mobile.security@samsung.com", "affectedData": [{"vendor": "Samsung Mobile", "product": "SamsungNotes", "versions": [{"status": "unaffected", "version": "4.4.30.63"}], "defaultStatus": "affected"}]}], "published": "2025-09-03T06:15:49.093", "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09", "tags": ["Vendor Advisory"], "source": "mobile.security@samsung.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is required for triggering this vulnerability."}, {"lang": "es", "value": "Control de acceso inadecuado en Samsung Notes anterior a la versi\u00f3n 4.4.30.63 permite a atacantes f\u00edsicos acceder a datos en m\u00faltiples perfiles de usuario. Se requiere interacci\u00f3n del usuario para activar esta vulnerabilidad."}], "lastModified": "2026-10-01T16:10:00.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:notes:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5029C1F8-35E0-44F9-B0CE-000486E267EB", "versionEndExcluding": "4.4.30.63"}], "operator": "OR"}]}], "sourceIdentifier": "mobile.security@samsung.com"}