VulnerabilityModified

CVE-2021-25447

Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview.

MEDIUM 5.3EPSS 0.79%

Does this matter?

Lower severity and a low EPSS score (0.79%). Track it; it rarely justifies an emergency change on its own.

Description

Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.79% probability · 54th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: samsung/smartthings firmware
Source: mobile.security@samsung.com

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=8Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.