CVE-2023-21438 | ByteOS Network

Vulnerability Details :

CVE-2023-21438

Assigner-Samsung Mobile

Assigner Org ID-3af57064-a867-422c-b2ad-40307b65c458

Published At-09 Feb, 2023 | 00:00

Updated At-24 Mar, 2025 | 18:54

Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:Samsung Mobile

Assigner Org ID:3af57064-a867-422c-b2ad-40307b65c458

Published At:09 Feb, 2023 | 00:00

Updated At:24 Mar, 2025 | 18:54

▼CVE Numbering Authority (CNA)

Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder.

Affected Products

Vendor

Samsung Electronics

Product

Samsung Mobile Devices

Versions

Affected

From R(11), S(12) before SMR Feb-2023 Release 1 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-284	CWE-284 Improper Access Control

Type: CWE

CWE ID: CWE-284

Description: CWE-284 Improper Access Control

Metrics

Version	Base score	Base severity	Vector
3.1	2.1	LOW	CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Version: 3.1

Base score: 2.1

Base severity: LOW

Vector:

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

Hyperlink	Resource
https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02	N/A

Hyperlink: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02	x_transferred

Hyperlink: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:mobile.security@samsung.com

Published At:09 Feb, 2023 | 19:15

Updated At:21 Feb, 2023 | 18:34

Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	2.4	LOW	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Secondary	3.1	2.1	LOW	CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Type: Primary

Version: 3.1

Base score: 2.4

Base severity: LOW

Vector:

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 2.1

Base severity: LOW

Vector:

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CPE Matches

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:-:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-apr-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-apr-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-apr-2023-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-aug-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-aug-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-aug-2023-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-dec-2020-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-dec-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-dec-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-dec-2023-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-feb-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-feb-2023-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-jan-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-jul-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-jul-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-jul-2023-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-jun-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-jun-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-jun-2023-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-mar-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-mar-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-mar-2023-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-may-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-may-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-may-2023-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-nov-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-nov-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-nov-2023-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-oct-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-oct-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-oct-2023-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-sep-2021-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-sep-2022-r1:*:*:*:*:*:*

>>android>>11.0

cpe:2.3:o:samsung:android:11.0:smr-sep-2023-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:-:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-apr-2022-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-apr-2023-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-aug-2022-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-aug-2023-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-dec-2021-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-dec-2022-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-dec-2023-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-feb-2022-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-feb-2023-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-jan-2022-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-jul-2022-r1:*:*:*:*:*:*

>>android>>12.0

cpe:2.3:o:samsung:android:12.0:smr-jul-2023-r1:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-668	Primary	nvd@nist.gov
CWE-284	Secondary	mobile.security@samsung.com

CWE ID: CWE-668

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-284

Type: Secondary

Source: mobile.security@samsung.com

References

Hyperlink	Source	Resource
https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02	mobile.security@samsung.com	Vendor Advisory

Hyperlink: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=02

Source: mobile.security@samsung.com

Resource:

Vendor Advisory

Similar CVEs

154Records found

Matching Score-4

Assigner-Apple Inc.

Matching Score-4

Assigner-Apple Inc.

CVSS Score-2.4||LOW

EPSS-0.03% / 6.50%

||

7 Day CHG~0.00%

Published-13 May, 2024 | 23:00

Updated-25 Mar, 2025 | 19:15

A permissions issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to share items from the lock screen.

Vendor-Apple Inc.

Product-iphone_os ipados iOS and iPadOS

CWE ID-CWE-284

Improper Access Control

Matching Score-4

Assigner-Apple Inc.

Matching Score-4

Assigner-Apple Inc.

CVSS Score-2.4||LOW

EPSS-0.08% / 23.38%

||

7 Day CHG~0.00%

Published-10 Jun, 2024 | 20:56

Updated-29 Mar, 2025 | 00:15

The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to access contacts from the lock screen.

Vendor-Apple Inc.

Product-ipados iphone_os iOS and iPadOS

CWE ID-CWE-284

Improper Access Control

Matching Score-4

Assigner-Apple Inc.

Matching Score-4

Assigner-Apple Inc.

CVSS Score-2.4||LOW

EPSS-0.02% / 2.34%

||

7 Day CHG-0.01%

Published-31 Mar, 2025 | 22:24

Updated-07 Apr, 2025 | 13:44

This issue was addressed with improved authentication. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker with a USB-C connection to an unlocked device may be able to programmatically access photos.

Vendor-Apple Inc.

Product-ipados iphone_os iOS and iPadOS

CWE ID-CWE-284

Improper Access Control

Matching Score-4

Assigner-Apple Inc.

Matching Score-4

Assigner-Apple Inc.

CVSS Score-2.4||LOW

EPSS-0.12% / 31.91%

||

7 Day CHG~0.00%

Published-29 Jul, 2024 | 22:16

Updated-27 Mar, 2025 | 16:15

This issue was addressed by restricting options offered on a locked device. This issue is fixed in watchOS 10.6, macOS Sonoma 14.6, iOS 17.6 and iPadOS 17.6, iOS 16.7.9 and iPadOS 16.7.9. An attacker with physical access to a device may be able to access contacts from the lock screen.

Vendor-Apple Inc.

Product-ipados iphone_os watchos macos iOS and iPadOS macOS watchOS

CWE ID-CWE-284

Improper Access Control