CVE-2025-2233: (0Day) (Pwn2Own) Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability
First published: Tue Mar 11 2025(Updated: )
Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Samsung SmartThings. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Hub Local API service, which listens on TCP port 8766 by default. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25615.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SmartThings | ||
| SmartThings |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2233?
CVE-2025-2233 is classified as a high severity vulnerability due to its potential for enabling unauthorized access.
What systems are affected by CVE-2025-2233?
CVE-2025-2233 affects installations of Samsung SmartThings where improper verification of cryptographic signatures occurs.
How do I fix CVE-2025-2233?
To fix CVE-2025-2233, ensure that you apply the latest security patches and updates provided by Samsung for SmartThings.
Can CVE-2025-2233 be exploited remotely?
Yes, CVE-2025-2233 can be exploited by network-adjacent attackers without requiring authentication.
What is the impact of exploiting CVE-2025-2233?
Exploiting CVE-2025-2233 allows attackers to bypass authentication, potentially leading to unauthorized access to sensitive functionalities.
- agent/references
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/source
- agent/author
- agent/severity
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-25-127
- alias/ZDI-CAN-25615
- alias/CVE-2025-2233
- vendor/samsung
- canonical/smartthings