Samsung Phone Flaws Added to CISA ‘Must Patch’ List Likely Exploited by Spyware Vendor

MuzzMelbourne

Level 15
Thread author
Verified
Top Poster
Well-known
Mar 13, 2022
593
CISA added eight new vulnerabilities to its catalog on Thursday, including two D-Link router and access point vulnerabilities exploited by a Mirai botnet variant. The six remaining security holes impact Samsung mobile devices and they were all patched by the technology giant in 2021.

The vulnerabilities include CVE-2021-25487, an out-of-bounds read in the modem interface driver that can lead to arbitrary code execution, fixed in October 2021. Samsung has classified the bug as ‘moderate’, but its NVD advisory says it’s ‘high severity’ based on CVSS score.

The same October 2021 round of patches also addresses CVE-2021-25489, a low-severity format string bug in the modem interface driver that can lead to a DoS condition.
 

MuzzMelbourne

Level 15
Thread author
Verified
Top Poster
Well-known
Mar 13, 2022
593
Entire article. Link for reference only.

US Cybersecurity and Infrastructure Security Agency (CISA) added six Samsung and two D-Link vulnerabilities to its Known Exploited Vulnerabilities Catalog.

Below is the list of flaws added to the catalog;

  • CVE-2019-17621 (CVSS score: 9.8) -D-Link DIR-859 Router Command Execution Vulnerability
  • CVE-2019-20500 (CVSS score: 7.8) – D-Link DWL-2600AP Access Point Command Injection Vulnerability
  • CVE-2021-25487 (CVSS score: 7.8) – Samsung Mobile Devices Out-of-Bounds Read Vulnerability
  • CVE-2021-25489 (CVSS score: 5.5) – Samsung Mobile Devices Improper Input Validation Vulnerability
  • CVE-2021-25394 (CVSS score: 6.4) – Samsung Mobile Devices Race Condition Vulnerability
  • CVE-2021-25395 (CVSS score: 6.4) – Samsung Mobile Devices Race Condition Vulnerability
  • CVE-2021-25371 (CVSS score: 6.7) – Samsung Mobile Devices Unspecified Vulnerability
  • CVE-2021-25372 (CVSS score: 6.7) – Samsung Mobile Devices Improper Boundary Check Vulnerability
The CVE-2019-17621 flaw is a remote command execution flaw that resides in the code used to manage UPnP requests. The vulnerability could be exploited by an unauthenticated attacker to take control of vulnerable devices. The vulnerability could be only exploited by an attacker with access to the same local area network segment of the vulnerable device.

Since March 2023, Unit 42 researchers have observed a variant of the Mirai botnet spreading by targeting tens of flaws in D-Link, Zyxel, and Netgear devices. The botnet targets multiple vulnerabilities in popular IoT devices, including the above issues.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix this flaw by July 20, 2023.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top