Samsung Cloud vulnerabilities
8 CVEs affecting Samsung Cloud, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20975, published 2026-01-09.
More from Samsung.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2022-33713, published 2022-07-12. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Implicit Intent hijacking vulnerability in Samsung Cloud prior to version 5.2.0 allows attacker to get sensitive information.
- CVE-2023-42578, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Improper handling of insufficient permissions or privileges vulnerability in Samsung Data Store prior to version 5.2.00.7 allows remote attackers to access location information without permission.
- CVE-2021-25368, published 2021-03-25. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed.
- CVE-2023-21448, published 2023-02-09. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Path traversal vulnerability in Samsung Cloud prior to version 5.3.0.32 allows attacker to access specific png file.
- CVE-2023-21447, published 2023-02-09. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access information with Samsung Cloud's privilege via implicit intent.
- CVE-2026-20975, published 2026-01-09. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arbitrary path.
- CVE-2024-20851, published 2024-04-02. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Improper access control vulnerability in Samsung Data Store prior to version 5.3.00.4 allows local attackers to launch arbitrary activity with Samsung Data Store privilege.
- CVE-2022-24932, published 2022-03-10. Medium severity, CVSS 4.6. EPSS: 0.1% chance of exploitation in the next 30 days. Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation before finishing Setup wizard.