Sign-up

ID

VAR-202107-1301


CVE

CVE-2021-25440


TITLE

SAMSUNG FactoryCameraFB Security hole

Trust: 0.6

sources: CNNVD: CNNVD-202107-439

DESCRIPTION

Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files with an escalated privilege. Samsung FactoryCameraFB is a system application of Samsung Corporation. Samsung Mobile FactoryCameraFB has an access control error vulnerability

Trust: 1.08

sources: NVD: CVE-2021-25440 // VULHUB: VHN-384237 // VULMON: CVE-2021-25440

AFFECTED PRODUCTS

vendor:samsungmodel:factorycamerafbscope:ltversion:3.4.74

Trust: 1.0

sources: NVD: CVE-2021-25440

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-25440
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202107-439
value: HIGH

Trust: 0.6

VULHUB: VHN-384237
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-25440
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-25440
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-384237
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-25440
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-384237 // VULMON: CVE-2021-25440 // CNNVD: CNNVD-202107-439 // NVD: CVE-2021-25440

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-284

Trust: 1.0

problemtype:CWE-863

Trust: 0.1

sources: VULHUB: VHN-384237 // NVD: CVE-2021-25440

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202107-439

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202107-439

EXTERNAL IDS

db:NVDid:CVE-2021-25440

Trust: 1.8

db:CNNVDid:CNNVD-202107-439

Trust: 0.6

db:CNVDid:CNVD-2021-52400

Trust: 0.1

db:VULHUBid:VHN-384237

Trust: 0.1

db:VULMONid:CVE-2021-25440

Trust: 0.1

sources: VULHUB: VHN-384237 // VULMON: CVE-2021-25440 // CNNVD: CNNVD-202107-439 // NVD: CVE-2021-25440

REFERENCES

url:https://blog.oversecured.com/two-weeks-of-securing-samsung-devices-part-2/

Trust: 1.7

url:https://security.samsungmobile.com/serviceweb.smsb?year=2021&month=7

Trust: 1.7

url:https://security.samsungmobile.com/serviceweb.smsb?year=2021&month=7

Trust: 0.1

url:https://cwe.mitre.org/data/definitions/863.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-384237 // VULMON: CVE-2021-25440 // CNNVD: CNNVD-202107-439 // NVD: CVE-2021-25440

SOURCES

db:VULHUBid:VHN-384237
db:VULMONid:CVE-2021-25440
db:CNNVDid:CNNVD-202107-439
db:NVDid:CVE-2021-25440

LAST UPDATE DATE

2024-08-14T15:42:51.157000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-384237date:2022-07-30T00:00:00
db:VULMONid:CVE-2021-25440date:2021-07-12T00:00:00
db:CNNVDid:CNNVD-202107-439date:2022-08-10T00:00:00
db:NVDid:CVE-2021-25440date:2022-07-30T12:56:51.790

SOURCES RELEASE DATE

db:VULHUBid:VHN-384237date:2021-07-08T00:00:00
db:VULMONid:CVE-2021-25440date:2021-07-08T00:00:00
db:CNNVDid:CNNVD-202107-439date:2021-07-08T00:00:00
db:NVDid:CVE-2021-25440date:2021-07-08T14:15:09.050