Medium severity · published Jul 6, 2023
CVE-2023-30675
Improper authentication in Samsung Pass prior to version 4.2.03.1 allows local attacker to access stored account information when Samsung Wallet is not installed
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Improper authentication in Samsung Pass prior to version 4.2.03.1 allows local attacker to access stored account information when Samsung Wallet is not installed.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Pass · Samsung
before 4.2.03.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-30675
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-30675
Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=07
More from Pass
9.8
CVE-2022-39892
Improper access control in Samsung Pass prior to version 4.0.05.1 allows attackers to unauthenticated access via keep open feature
6.8
CVE-2023-42576
Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid exception handler
6.8
CVE-2023-42575
Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid flag setting
6.8
CVE-2023-42554
Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication
6.8
CVE-2022-39911
Improper check or handling of exceptional conditions vulnerability in Samsung Pass prior to version 4.0.06.1 allows attacker to access Samsung Pass