CVE-2021-25337

CVE-2021-25337 is an improper access control flaw (CWE-269) in the clipboard service of Samsung mobile devices, present in devices running security patch levels prior to Samsung's March 2021 Security Maintenance Release (SMR Mar-2021 Release 1). An untrusted application installed on the device can abuse the flaw to read or write certain local files that it should not be able to access, meaning a malicious or compromised app gains unauthorized access to sensitive data or can tamper with files on the device. The attack is local (AV:L) and requires user interaction, so exploitation requires a hostile app already running on the handset rather than a remote or network-based attack. All Samsung mobile devices on patch levels older than the March 2021 SMR are affected until they are updated. Exploitation is confirmed in the wild: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2022-11-08, and related reporting indicates a surveillance vendor exploited Samsung phone zero-days, though no public proof-of-concept is known and ransomware use is unknown.

What to do: Update affected Samsung devices to SMR Mar-2021 Release 1 or a later monthly security maintenance release via the vendor's update mechanism (Settings > Software update), per CISA's required action to apply vendor updates. For fleets, check device security patch levels via MDM or the device's security patch version in Settings and confirm it is March 2021 or newer; treat any untrusted sideloaded apps on unpatched devices as potential local file-access risk.