Samsung Galaxy Watch Plugin vulnerabilities

6 CVEs affecting Samsung Galaxy Watch Plugin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-36875, published 2022-09-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-25420, published 2021-06-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
CVE-2022-36873, published 2022-09-09. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper restriction of broadcasting Intent in GalaxyStoreBridgePageLinker of?Waterplugin prior to version 2.2.11.22081151 leaks MAC address of the connected Bluetooth device.
CVE-2022-25827, published 2022-03-10. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25823, published 2022-03-10. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log.
CVE-2022-36874, published 2022-09-09. Medium severity, CVSS 6.2. EPSS: 0.2% chance of exploitation in the next 30 days. Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access device IMEI and Serial number.
CVE-2022-36875, published 2022-09-09. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file without permission.