CVE-2026-21131: Low severity Samsung Samsung Flow vulnerability
Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Samsung Flowto a version that resolves this vulnerability.Fixed in 4.9.22.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices using Samsung Flow earlier than version 4.9.22.4 are affected. Exploitation concerns the connected device, where an attacker may launch an activity with Samsung Flow privileges.
What access does an attacker need?
The attacker needs local access. The CVSS vector indicates no privileges or user interaction are required, but the attack conditions are marked as present.
What should be done to remediate the issue?
Update Samsung Flow to version 4.9.22.4 or later. The issue is caused by an incorrect default permission in earlier versions.