CVE-2025-21049: Medium severity Samsung Android vulnerability
Published Oct 10, 2025
·Updated
Improper access control in SecSettings prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
Affected Software
11 affected components
Samsung Android=15.0
Samsung Android=15.0-smr-apr-2025-r1
Samsung Android=15.0-smr-aug-2025-r1
Samsung Android=15.0-smr-jul-2025-r1
Samsung Android=15.0-smr-jun-2025-r1
Samsung Android=15.0-smr-mar-2025-r1
Samsung Android=15.0-smr-may-2025-r1
Samsung Android=15.0-smr-sep-2025-r1
Samsung Android=16.0
Samsung Android=16.0-smr-aug-2025-r1
Samsung Android=16.0-smr-sep-2025-r1
Event History
Oct 10, 2025
CVE Published
via MITRE·06:33 AM
Data Sourced
via MITRE·06:33 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-21049?
CVE-2025-21049 is classified as a medium severity vulnerability due to improper access control allowing local attacks.
2
How do I fix CVE-2025-21049?
To resolve CVE-2025-21049, apply the latest security updates provided by Samsung for affected Android versions.
3
What causes the vulnerability CVE-2025-21049?
CVE-2025-21049 is caused by improper access control in the SecSettings, which allows access to sensitive information.
4
Is user interaction required for CVE-2025-21049?
Yes, user interaction is required to trigger the vulnerability CVE-2025-21049.
5
Which software versions are affected by CVE-2025-21049?
CVE-2025-21049 affects Samsung Android versions 15.0 and 16.0 across various security maintenance releases.