SM
Product
Smartthings
17
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 12Medium 3Low 1
Watch
Add Smartthings to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-25508 | 9.8 | Nov 5 | Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation Affected: before 1.7.73.22 |
| CVE-2025-2233 | 8.8 | Mar 11 | Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability Affected: before 0.55.5 |
| CVE-2022-30749 | 7.8 | Jun 7 | Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity Affected: before 1.7.85.25 |
| CVE-2024-34596 | 7.5 | Jul 2 | Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner Affected: before 1.8.17 |
| CVE-2022-39867 | 7.5 | Oct 7 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via… Affected: before 1.7.89.0 |
| CVE-2022-39864 | 7.5 | Oct 7 | Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via implicit intent Affected: before 1.7.85.25 |
| CVE-2022-39865 | 7.5 | Oct 7 | Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast Affected: before 1.7.89.0 |
| CVE-2022-39866 | 7.5 | Oct 7 | Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast Affected: before 1.7.89.0 |
| CVE-2022-39868 | 7.5 | Oct 7 | Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast Affected: before 1.7.89.0 |
| CVE-2022-39869 | 7.5 | Oct 7 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via… Affected: before 1.7.89.0 |
| CVE-2022-39870 | 7.5 | Oct 7 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via… Affected: before 1.7.89.0 |
| CVE-2022-39871 | 7.5 | Oct 7 | Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit… Affected: before 1.7.89.0 |
| CVE-2022-30746 | 7.5 | Jun 7 | Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API Affected: before 1.7.85.12 |
| CVE-2024-49416 | 5.5 | Dec 3 | Use of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows local attackers to get sensitive information Affected: before 1.8.21 |
| CVE-2022-30747 | 5.5 | Jun 7 | PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent Affected: before 1.7.85.25 |
| CVE-2021-25378 | 5.3 | Apr 9 | Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service Affected: before 1.7.63.6 |
| CVE-2024-20852 | 3.3 | Apr 2 | Improper verification of intent by broadcast receiver vulnerability in SmartThings prior to version 1.8.13.22 allows local attackers to access testing configuration Affected: before 1.8.13.22 |
Showing 17