Samsung Smartthings vulnerabilities

17 CVEs affecting Samsung Smartthings, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-2233, published 2025-03-11.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-25378, published 2021-04-09. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service.
• CVE-2022-30746, published 2022-06-07. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API.
• CVE-2021-25508, published 2021-11-05. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation.
• CVE-2025-2233, published 2025-03-11. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected…
• CVE-2024-34596, published 2024-07-02. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner.
• CVE-2022-39871, published 2022-10-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcasts.
• CVE-2022-39870, published 2022-10-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via PUSH_MESSAGE_RECEIVED broadcast.
• CVE-2022-39869, published 2022-10-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via REMOVE_PERSISTENT_BANNER broadcast.
• CVE-2022-39868, published 2022-10-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.
• CVE-2022-39867, published 2022-10-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via SHOW_PERSISTENT_BANNER broadcast.

Latest

• CVE-2024-49416, published 2024-12-03. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Use of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows local attackers to get sensitive information.
• CVE-2024-20852, published 2024-04-02. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. Improper verification of intent by broadcast receiver vulnerability in SmartThings prior to version 1.8.13.22 allows local attackers to access testing configuration.
• CVE-2022-39866, published 2022-10-07. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.