CISA Flags 8 Actively Exploited Flaws in Samsung and D

CVE-2019-17621 is an unauthenticated OS command injection flaw (CWE-78) in the UPnP endpoint /gena.cgi of D-Link DIR-859 Wi-Fi router firmware 1.05 and 1.06B01 Beta01. An attacker who can reach the UPnP service — typically by being on the local network — sends a specially crafted HTTP SUBSCRIBE request that injects and executes system commands. Because the service runs with root privileges, successful exploitation gives the attacker full control of the router, enabling configuration changes, traffic manipulation, and recruitment into botnets such as Mirai. The CISA-affected product is the DIR-859, with related D-Link DIR-series router firmware also listed in the CPE data, and public proof-of-concept references are available. The flaw is actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-06-29, and current headlines describe Mirai botnet campaigns leveraging it among multiple IoT flaws.

Do: Apply the latest D-Link firmware updates per vendor instructions; because the DIR-859 is an older model that may no longer receive updates, CISA's required action is to discontinue use of the product if a fixed release is unavailable. If the router is not at end of life, restrict or disable UPnP where unused and ensure the UPnP endpoint is not reachable beyond the LAN, then check for signs of botnet compromise such as unusual outbound traffic or unauthorized configuration changes.

D-Link DWL-2600AP access points running firmware 4.2.0.15 Rev A contain an authenticated OS command injection flaw (CWE-78) in the web interface's Save Configuration function (admin.cgi?action=config_save). An attacker with valid credentials submits shell metacharacters in the configBackup or downloadServerip parameters, causing arbitrary operating-system commands to execute on the device. Successful exploitation yields command execution on the access point itself, which can be used to pivot into the local network or to conscript the device into botnets, consistent with the recently reported Mirai campaign targeting multiple IoT device flaws. Any organization still running the affected DWL-2600AP hardware is exposed, especially where the management web interface is reachable from untrusted networks. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2023-06-29, confirming active in-the-wild exploitation, and it carries a very high EPSS (~97%) alongside a public proof-of-concept (Exploit-DB 46841).

Do: Inventory all DWL-2600AP units, identify devices on the vulnerable firmware revision, and apply D-Link's latest available firmware per vendor instructions; because this product line is end-of-life, CISA's required action explicitly permits discontinuing use of the product if updates are unavailable. In the interim, restrict access to the web management interface (admin.cgi) to trusted management networks, remove any internet exposure, and ensure default or shared administrator credentials have been changed, since exploitation requires authentication.

CVE-2021-25372 is an improper boundary check in the DSP (Digital Signal Processor) driver on Samsung mobile devices, which allows an out-of-bounds memory access when processing malformed inputs. The flaw is triggered locally on affected Samsung devices running a security patch level older than the March 2021 Samsung Maintenance Release (SMR Mar-2021 Release 1). A successful exploit yields high impact to confidentiality, integrity, and availability on the device (memory corruption class bug, CWE-787), and given its local attack vector it is most plausibly used as a step in a broader exploit chain rather than a remote, standalone attack. All Samsung Android smartphones and tablets that have not received the March 2021 (or later) security update are affected. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2023-06-29, confirming it is being actively exploited in the wild, though details of specific ransomware or campaign use are unknown.

Do: Update affected Samsung devices to the SMR Mar-2021 Release 1 security patch (Android security patch level 2021-03-01) or any later monthly release, per Samsung's instructions; this is the required action listed in CISA's KEV catalog. Fleet managers should check device patch levels via Settings > About phone > Software information > Android security patch version and treat any device below 2021-03-01 as vulnerable. Because the bug is locally exploitable and actively exploited, prioritize patching devices used by high-risk users and verify no exploit chain relyed on unpatched DSP drivers.

CVE-2021-25394 is a use-after-free vulnerability caused by a race condition in the MFC charger driver on Samsung mobile devices, fixed in Samsung's May 2021 security release (SMR MAY-2021 Release 1). The flaw is triggered when the driver frees a memory object while it is still in use during charger-driver processing, and it can only be exploited to gain an arbitrary write if the attacker has already compromised radio (baseband) privileges, making it a second stage in a modem-to-kernel exploit chain. A successful exploit yields an arbitrary write in kernel space, which an attacker can use to escalate privileges and take full control of the device. Any Samsung mobile device running firmware older than the May 2021 security release is affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2023-06-29, confirming exploitation in the wild, though EPSS estimates only a 0.4% probability of exploitation in the next 30 days and no public proof-of-concept is known.

Do: Apply the SMR MAY-2021 Release 1 security update, or a later Samsung monthly security release, to all Samsung mobile devices, in line with CISA's required action to apply updates per vendor instructions. Because exploitation requires a previously compromised radio, keep baseband/modem firmware current as well. Verify the device security patch level is May 2021 or later before treating it as remediated.

CVE-2021-25487 is an out-of-bounds read (CWE-125) in the set_skb_priv() function of the modem interface driver on Samsung mobile devices, caused by missing boundary checking of a buffer. The flaw is triggered when the driver processes data without validating buffer bounds, and per the CVSS vector exploitation is local (AV:L), requiring low privileges and no user interaction. By dereferencing an invalid function pointer, the attacker achieves arbitrary code execution with high impact on confidentiality, integrity, and availability, effectively enabling compromise of the affected phone or tablet. Affected products are Samsung mobile devices (Android) running firmware prior to the Samsung Security Maintenance Release (SMR) Oct-2021 Release 1. The flaw is actively exploited in the wild per its addition to the CISA Known Exploited Vulnerabilities catalog on 2023-06-29; no public PoC is known and ransomware use is unknown.

Do: Apply Samsung's SMR Oct-2021 Release 1 or any later security maintenance release via Settings > Software update or through your enterprise MDM/UEM, per CISA's required action for KEV entries. Verify device security patch level is October 2021 or newer, and prioritize any Samsung handsets still below that patch level given confirmed active exploitation.