by Kastro
Paper/Archive/CVE-2021-25508

CVE-2021-25508

Samsung Mobile SmartThings — Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key wit…

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.5.575 × 2011.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation.

Affected

ProductAffectedFixed inSource
SmartThings- – < 1.7.73.221.7.73.22CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Samsung Mobile (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

refsecurity.samsungmobile.com/serviceWeb.smsb?year=2021&month=11