CVE-2023-21441

HIGH

Samsung Android Routine < 2.6.30.6 (Q), < 3.1.21.10 (R), < 3.5.2.23 (S) - Insufficient Verification of Data Authenticity

Title source: llm

Description

Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.1.21.10 in Android R(11) and 3.5.2.23 in Android S(12) allows local attacker to access protected files via unused code.

References (1)

Core 1

Core References

Vendor Advisory

https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02

Scores

CVSS v3 7.4

EPSS 0.0010

EPSS Percentile 1.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-345

Status published

Products (1)

samsung/android 10.0 (50 CPE variants)

Published Feb 09, 2023

Tracked Since Feb 18, 2026