CVE-2026-125715: Medium severity vulnerability

Published Nov 10, 2026

Updated

Samsung mTower lacks access control for TA sessions, allowing a Normal World application to open TA sessions and invoke their commands, or use a close existing sessions if thier identifiers are known, The impact depends on the affected TA.

Event History

Nov 10, 2026

CVE Published

via NVD·12:17 PM

Data Sourced

via NVD·12:17 PM

DescriptionSeverity

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker needs the ability to run a Normal World application locally. No user interaction is required.

What can an unauthorized Normal World application do?

It can open sessions to Trusted Applications and invoke their commands. If it knows existing session identifiers, it can also close those sessions.

How severe is the impact in a particular deployment?

The impact depends on the affected Trusted Application. The reported CVSS vector indicates potential low confidentiality, integrity, and availability impact.

CVE-2026-125715: Medium severity vulnerability

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What can an unauthorized Normal World application do?

How severe is the impact in a particular deployment?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What can an unauthorized Normal World application do?

How severe is the impact in a particular deployment?