CVE-2025-21079

Published Nov 5, 2025

Last updated 6 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-21079 describes an improper input validation vulnerability found in Samsung Members, affecting versions prior to 5.5.01.3. This flaw could enable remote attackers to connect to arbitrary URLs and initiate arbitrary activities, leveraging the privileges of the Samsung Members application. Exploitation of this vulnerability requires user interaction.

Description: Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilege. User interaction is required for triggering this vulnerability.
Source: mobile.security@samsung.com
NVD status: Analyzed
Products: members

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.1
Impact score: 5.2
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Severity: HIGH

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:samsung:members:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "24656E89-FEB3-4A82-BC26-DFE849A75DDF",
            "versionEndExcluding": "5.5.01.3",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.