Samsung Watch Active Plugin vulnerabilities

2 CVEs affecting Samsung Watch Active Plugin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-25828, published 2022-03-10.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-25422, published 2021-06-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
• CVE-2022-25828, published 2022-03-10. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp in the log