CVE-2017-3218

High

Published: 21/06/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Samsung Magician version 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician used HTTP for software updates.

Risk Assessment

The lack of TLS certificate validation may lead to man-in-the-middle attacks, exposing users to unauthorized software updates.

Recommendation

It is recommended to update to the latest version of Samsung Magician that improves TLS certificate validation.

Other vulnerabilities in Samsung Magician

CVE-2025-57836High
In Samsung Magician versions 6.3.0 through 8.3.2 on Windows, the installer creates a temporary folder with weak permissions during installation. This allows a non-admin user to perform DLL hijacking and escalate privileges.

Original NVD description (English source)

Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.