VulnerabilityModified

CVE-2021-25446

Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview.

MEDIUM 5.3EPSS 0.81%

Does this matter?

Lower severity and a low EPSS score (0.81%). Track it; it rarely justifies an emergency change on its own.

Description

Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.81% probability · 55th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: samsung/smartthings firmware
Source: mobile.security@samsung.com

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.