Actively exploited in the wild

Samsung Mobile Devices Improper Input Validation Vulnerability

Samsung - Mobile Devices · Listed in the CISA KEV since 2023-06-29. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

CVE-2021-25489

LowCVSS 3.3KEV

Published: 06/10/2021(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Assuming radio permission is gained, missing input validation in the modem interface driver prior to SMR Oct-2021 Release 1 results in a format string bug leading to kernel panic.

Risk Assessment

An attacker with radio permissions can trigger a kernel panic, causing a denial of service.

Recommendation

Update the modem software to SMR Oct-2021 Release 1 or later.

Other vulnerabilities in Modem interface driver

CVE-2021-25487HighActively exploited
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.

Original NVD description (English source)

Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.