Medium severity · published Apr 9, 2021
CVE-2021-25375
Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open the malicious…
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open the malicious attachment.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Email · Samsung
before 6.1.14.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-25375
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-25375
Vendor Advisory
https://security.samsungmobile.com/
Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb
More from Email
7.5
CVE-2023-30729
Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including sensitive information
5.5
CVE-2024-34636
Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to get sensitive information
5.5
CVE-2024-20867
Improper privilege management vulnerability in Samsung Email prior to version 6.1.91.14 allows local attackers to access sensitive information
5.3
CVE-2023-42553
Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email
5.3
CVE-2021-25376
An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLS negotiation is failed