VulnerabilityModified

CVE-2021-25525

Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows attacker to use NFC without user recognition.

MEDIUM 6.5EPSS 0.33%

Does this matter?

Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.

Description

Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows attacker to use NFC without user recognition.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.33% probability · 26th percentile
CISA KEV: Not listed
Weakness: CWE-703, CWE-754
Affected: samsung/pay
Source: mobile.security@samsung.com

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.