Samsung Pass vulnerabilities

5 CVEs affecting Samsung Pass, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-36876, published 2022-09-09.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-25505, published 2021-11-05. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked.
• CVE-2022-36876, published 2022-09-09. Low severity, CVSS 2.4. EPSS: 0.3% chance of exploitation in the next 30 days. Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication.
• CVE-2022-36851, published 2022-09-09. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a certain state of an unlocked device.
• CVE-2022-27841, published 2022-04-11. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Improper exception handling in Samsung Pass prior to version 3.7.07.5 allows physical attacker to view the screen that is previously running without authentication
• CVE-2022-30730, published 2022-06-07. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authentication.