CVE-2025-20956: Medium severity Samsung Galaxy Watch vulnerability
Published May 7, 2025
·Updated
Improper export of android application components in Settings in Galaxy Watch prior to SMR May-2025 Release 1 allows physical attackers to access developer settings.
Affected Software
12 affected components
Samsung Galaxy Watch<SMR May-2025 Release 1
All of the following
Samsung Wear Os=5.0
Any of the following
Samsung Galaxy Watch
Samsung Galaxy Watch 4
Samsung Galaxy Watch 4 Classic
Samsung Galaxy Watch 5
Samsung Galaxy Watch 5 Pro
Samsung Galaxy Watch 6
Samsung Galaxy Watch 6 Classic
Samsung Galaxy Watch 7
Samsung Galaxy Watch Fe
Samsung Galaxy Watch Ultra
Event History
May 7, 2025
CVE Published
via MITRE·08:24 AM
Data Sourced
via MITRE·08:24 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-20956?
CVE-2025-20956 is considered a high severity vulnerability due to improper access control that allows physical attackers to exploit the device.
2
How do I fix CVE-2025-20956?
To fix CVE-2025-20956, update your Galaxy Watch to the SMR May-2025 Release 1 or later.
3
What components are affected by CVE-2025-20956?
CVE-2025-20956 affects the export of application components in the Settings app of Galaxy Watch.
4
Who is impacted by CVE-2025-20956?
All users of Samsung Galaxy Watch running versions prior to SMR May-2025 Release 1 are impacted by CVE-2025-20956.
5
Can CVE-2025-20956 be exploited remotely?
CVE-2025-20956 cannot be exploited remotely; it requires physical access to the device.