# Samsung Mobile Devices. Every CVE that names Samsung Mobile Devices among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list.](https://agentprime.io/advisories/CVE-2024-49414.md) `CVE-2024-49414` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 2.4 Low · Not analysed yet · Published 3 Dec 2024 - [Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications.](https://agentprime.io/advisories/CVE-2024-49413.md) `CVE-2024-49413` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.1 High · Not analysed yet · Published 3 Dec 2024 - [Improper input validation in Settings prior to SMR Dec-2024 Release 1 allows local attackers to broadcast signal for discovering Bluetooth on Galaxy Watch.](https://agentprime.io/advisories/CVE-2024-49412.md) `CVE-2024-49412` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.5 Medium · Not analysed yet · Published 3 Dec 2024 - [Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege.](https://agentprime.io/advisories/CVE-2024-49411.md) `CVE-2024-49411` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.3 Medium · Not analysed yet · Published 3 Dec 2024 - [Out-of-bounds write in libswmfextractor.so prior to SMR Dec-2024 Release 1 allows local attackers to execute arbitrary code.](https://agentprime.io/advisories/CVE-2024-49410.md) `CVE-2024-49410` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.9 Medium · Not analysed yet · Published 3 Dec 2024 - [Out-of-bounds write in Battery Full Capacity node prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory.](https://agentprime.io/advisories/CVE-2024-49409.md) `CVE-2024-49409` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.4 Medium · Not analysed yet · Published 6 Nov 2024 - [Out-of-bounds write in usb driver prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memory.](https://agentprime.io/advisories/CVE-2024-49408.md) `CVE-2024-49408` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.4 Medium · Not analysed yet · Published 6 Nov 2024 - [Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles.](https://agentprime.io/advisories/CVE-2024-49402.md) `CVE-2024-49402` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.6 Medium · Not analysed yet · Published 6 Nov 2024 - [Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities.](https://agentprime.io/advisories/CVE-2024-49401.md) `CVE-2024-49401` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 6 Nov 2024 - [Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi password in Maintenance Mode.](https://agentprime.io/advisories/CVE-2024-34682.md) `CVE-2024-34682` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 2.4 Low · Not analysed yet · Published 6 Nov 2024 - [Improper input validation in BluetoothAdapter prior to SMR Nov-2024 Release 1 allows local attackers to cause local permanent denial of service on Galaxy Watch.](https://agentprime.io/advisories/CVE-2024-34681.md) `CVE-2024-34681` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.6 Medium · Not analysed yet · Published 6 Nov 2024 - [Use of implicit intent for sensitive communication in WlanTest prior to SMR Nov-2024 Release 1 allows local attackers to get sensitive information.](https://agentprime.io/advisories/CVE-2024-34680.md) `CVE-2024-34680` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 6 Nov 2024 - [Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege.](https://agentprime.io/advisories/CVE-2024-34679.md) `CVE-2024-34679` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 6 Nov 2024 - [Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption.](https://agentprime.io/advisories/CVE-2024-34678.md) `CVE-2024-34678` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.9 Medium · Not analysed yet · Published 6 Nov 2024 - [Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate.](https://agentprime.io/advisories/CVE-2024-34677.md) `CVE-2024-34677` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 6 Nov 2024 - [Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption.](https://agentprime.io/advisories/CVE-2024-34676.md) `CVE-2024-34676` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.4 Medium · Not analysed yet · Published 6 Nov 2024 - [Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen.](https://agentprime.io/advisories/CVE-2024-34675.md) `CVE-2024-34675` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 2.4 Low · Not analysed yet · Published 6 Nov 2024 - [Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles.](https://agentprime.io/advisories/CVE-2024-34674.md) `CVE-2024-34674` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.6 Medium · Not analysed yet · Published 6 Nov 2024 - [Improper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local attackers to cause Denial-of-Service.](https://agentprime.io/advisories/CVE-2024-34673.md) `CVE-2024-34673` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.1 Medium · Not analysed yet · Published 6 Nov 2024 - [Out-of-bounds write in parsing h.263+ format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege.](https://agentprime.io/advisories/CVE-2024-34669.md) `CVE-2024-34669` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 - [Out-of-bounds write in parsing h.263 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege.](https://agentprime.io/advisories/CVE-2024-34668.md) `CVE-2024-34668` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 - [Out-of-bounds write in parsing h.265 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege.](https://agentprime.io/advisories/CVE-2024-34667.md) `CVE-2024-34667` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 - [Out-of-bounds write in parsing h.264 format in a specific mode in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege.](https://agentprime.io/advisories/CVE-2024-34666.md) `CVE-2024-34666` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 - [Out-of-bounds write in parsing h.264 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege.](https://agentprime.io/advisories/CVE-2024-34665.md) `CVE-2024-34665` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 - [Improper check for exception conditions in Knox Guard prior to SMR Oct-2024 Release 1 allows physical attackers to bypass Knox Guard in a multi-user environment.](https://agentprime.io/advisories/CVE-2024-34664.md) `CVE-2024-34664` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.1 Medium · Not analysed yet · Published 8 Oct 2024 - [Integer overflow in libSEF.quram.so prior to SMR Oct-2024 Release 1 allows local attackers to write out-of-bounds memory.](https://agentprime.io/advisories/CVE-2024-34663.md) `CVE-2024-34663` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2024 - [Improper access control in ActivityManager prior to SMR Oct-2024 Release 1 in select Android 12, 13 and SMR Sep-2024 Release 1 in select Android 14 allows local attackers to execute privileged behavi…](https://agentprime.io/advisories/CVE-2024-34662.md) `CVE-2024-34662` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 8 Oct 2024 - [Incorrect use of privileged API in UniversalCredentialManager prior to SMR Sep-2024 Release 1 allows local attackers to access privileged API related to UniversalCredentialManager.](https://agentprime.io/advisories/CVE-2024-34655.md) `CVE-2024-34655` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access files with My Files' privilege.](https://agentprime.io/advisories/CVE-2024-34654.md) `CVE-2024-34654` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 4 Sept 2024 - [Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access directories with My Files' privilege.](https://agentprime.io/advisories/CVE-2024-34653.md) `CVE-2024-34653` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.6 Medium · Not analysed yet · Published 4 Sept 2024 - [Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information related to performance including app usage.](https://agentprime.io/advisories/CVE-2024-34652.md) `CVE-2024-34652` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files.](https://agentprime.io/advisories/CVE-2024-34651.md) `CVE-2024-34651` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 4 Sept 2024 - [Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel.](https://agentprime.io/advisories/CVE-2024-34650.md) `CVE-2024-34650` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper access control in new Dex Mode in multitasking framework prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access an unlocked screen.](https://agentprime.io/advisories/CVE-2024-34649.md) `CVE-2024-34649` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 2.4 Low · Not analysed yet · Published 4 Sept 2024 - [Improper Handling of Insufficient Permissions in KnoxMiscPolicy prior to SMR Sep-2024 Release 1 allows local attackers to access sensitive data.](https://agentprime.io/advisories/CVE-2024-34648.md) `CVE-2024-34648` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2024 - [Incorrect use of privileged API in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to knox without proper license.](https://agentprime.io/advisories/CVE-2024-34647.md) `CVE-2024-34647` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper access control in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to cause local permanent denial of service.](https://agentprime.io/advisories/CVE-2024-34646.md) `CVE-2024-34646` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.6 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper input validation in ThemeCenter prior to SMR Sep-2024 Release 1 allows physical attackers to install privileged applications.](https://agentprime.io/advisories/CVE-2024-34645.md) `CVE-2024-34645` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.1 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper access control in item selection related in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data.](https://agentprime.io/advisories/CVE-2024-34644.md) `CVE-2024-34644` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.4 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data.](https://agentprime.io/advisories/CVE-2024-34643.md) `CVE-2024-34643` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.4 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information.](https://agentprime.io/advisories/CVE-2024-34642.md) `CVE-2024-34642` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.6 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allows local attackers to enable NFC configuration.](https://agentprime.io/advisories/CVE-2024-34641.md) `CVE-2024-34641` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper access control vulnerability in BGProtectManager prior to SMR Sep-2024 Release 1 allows local attackers to bypass restriction of process expiration.](https://agentprime.io/advisories/CVE-2024-34640.md) `CVE-2024-34640` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 3.3 Low · Not analysed yet · Published 4 Sept 2024 - [Improper handling of exceptional conditions in Setupwizard prior to SMR Aug-2024 Release 1 allows physical attackers to bypass proper validation.](https://agentprime.io/advisories/CVE-2024-34639.md) `CVE-2024-34639` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.6 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper handling of exceptional conditions in ThemeCenter prior to SMR Sep-2024 Release 1 allows local attackers to delete non-preloaded applications.](https://agentprime.io/advisories/CVE-2024-34638.md) `CVE-2024-34638` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.7 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows local attackers to bypass restrictions on…](https://agentprime.io/advisories/CVE-2024-34637.md) `CVE-2024-34637` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 4 Sept 2024 - [Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileged service.](https://agentprime.io/advisories/CVE-2024-34620.md) `CVE-2024-34620` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 8.4 High · Not analysed yet · Published 7 Aug 2024 - [Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege.](https://agentprime.io/advisories/CVE-2024-34619.md) `CVE-2024-34619` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2024 - [Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell related information.](https://agentprime.io/advisories/CVE-2024-34618.md) `CVE-2024-34618` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 7 Aug 2024 - [Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Message application.](https://agentprime.io/advisories/CVE-2024-34617.md) `CVE-2024-34617` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 7 Aug 2024 - [Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive data.](https://agentprime.io/advisories/CVE-2024-34616.md) `CVE-2024-34616` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 7 Aug 2024 - [Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to cause memory corruption.](https://agentprime.io/advisories/CVE-2024-34615.md) `CVE-2024-34615` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 7 Aug 2024 - [Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code.](https://agentprime.io/advisories/CVE-2024-34614.md) `CVE-2024-34614` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.3 High · Not analysed yet · Published 7 Aug 2024 - [Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive information of Galaxy watch.](https://agentprime.io/advisories/CVE-2024-34613.md) `CVE-2024-34613` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.0 Medium · Not analysed yet · Published 7 Aug 2024 - [Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code.](https://agentprime.io/advisories/CVE-2024-34612.md) `CVE-2024-34612` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 7.3 High · Not analysed yet · Published 7 Aug 2024 - [Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive information.](https://agentprime.io/advisories/CVE-2024-34611.md) `CVE-2024-34611` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 7 Aug 2024 - [Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data.](https://agentprime.io/advisories/CVE-2024-34610.md) `CVE-2024-34610` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 7 Aug 2024 - [Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.](https://agentprime.io/advisories/CVE-2024-34609.md) `CVE-2024-34609` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 7 Aug 2024 - [Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.](https://agentprime.io/advisories/CVE-2024-34608.md) `CVE-2024-34608` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 7 Aug 2024 - [Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background.](https://agentprime.io/advisories/CVE-2024-34607.md) `CVE-2024-34607` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.2 Medium · Not analysed yet · Published 7 Aug 2024 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .