Samsung Pass vulnerabilities

10 CVEs affecting Samsung Pass, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-49405, published 2024-11-06.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-39892, published 2022-11-09. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control in Samsung Pass prior to version 4.0.05.1 allows attackers to unauthenticated access via keep open feature.
• CVE-2023-42576, published 2023-12-05. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid exception handler.
• CVE-2023-42575, published 2023-12-05. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid flag setting.
• CVE-2023-42554, published 2023-11-07. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication.
• CVE-2022-39910, published 2022-12-08. Medium severity, CVSS 4.2. EPSS: 0.3% chance of exploitation in the next 30 days. Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on a certain state of an unlocked device using pop-up view.
• CVE-2022-39911, published 2022-12-08. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper check or handling of exceptional conditions vulnerability in Samsung Pass prior to version 4.0.06.1 allows attacker to access Samsung Pass.
• CVE-2023-30677, published 2023-07-06. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Improper access control vulnerability in Samsung Pass prior to version 4.2.03.1 allows physical attackers to access data of Samsung Pass on a certain state of an unlocked device.
• CVE-2023-30676, published 2023-07-06. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Improper access control vulnerability in Samsung Pass prior to version 4.2.03.1 allows physical attackers to access data of Samsung Pass.
• CVE-2024-49405, published 2024-11-06. Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days. Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive information in a specific scenario.
• CVE-2023-30675, published 2023-07-06. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper authentication in Samsung Pass prior to version 4.2.03.1 allows local attacker to access stored account information when Samsung Wallet is not installed.