← Vulnerability feed

Vulnerability record · CVE-2015-7888 · published 7 June 2017

CVE-2015-7888: Samsung galaxy s6 edge firmware path traversal vulnerability

Samsung · Galaxy S6 Edge Firmware

Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the system-level user via a .. (dot dot) in the name of a file, compressed into a zipped file named cred.zip, and downloaded to /sdcard/Download.

7.5 CVSS 3.0 High EPSS 4.1% · top 9.7% CWE-22 · Path traversal
7.5CVSS 3.0 base score, v2 7.8
4.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the system-level user via a .. (dot dot) in the name of a file, compressed into a zipped file named cred.zip, and downloaded to /sdcard/Download.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/134104/Samsung-WifiHs20UtilityService-Path-Traversal.html Third Party Advisory
http://www.securityfocus.com/bid/77338 Third Party AdvisoryVDB Entry
https://bugs.chromium.org/p/project-zero/issues/detail?id=489&q=samsung&redir=1 Issue TrackingThird Party Advisory
http://packetstormsecurity.com/files/134104/Samsung-WifiHs20UtilityService-Path-Traversal.html Third Party Advisory
http://www.securityfocus.com/bid/77338 Third Party AdvisoryVDB Entry
https://bugs.chromium.org/p/project-zero/issues/detail?id=489&q=samsung&redir=1 Issue TrackingThird Party Advisory

Track CVE-2015-7888 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2015-7894Samsung galaxy s6 edge firmware memory buffer overflow vulnerabilityThe DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers to cause a…EPSS 8.9%5.5CVE-2015-7890Samsung galaxy s6 edge firmware classic buffer overflow vulnerabilityMultiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to…EPSS 1.3%4.2CVE-2019-12762Mi 5s plus firmware vulnerabilityXiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 kHz, as demonstrated by a trans…EPSS 0.18%9.8CVE-2026-93616Checkpoint multi-domain security management path traversal vulnerabilityA directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Managem…KEVEPSS 20%10.0CVE-2026-85706GitLab CE/EE repository commits API path traversal allows unauthenticated file readGitLab CE/EE contains improper path confinement and missing authentication enforcement in the repository commits API, allowing an unauthenticated use…KEVEPSS 91%analysed5.3CVE-2026-66384JFrog Artifactory path traversal in Docker cache pathAn authenticated user can write data outside the intended Docker cache path under specific remote-repository conditions in JFrog Artifactory. The fla…KEVEPSS 0.66%analysed9.8CVE-2026-59310VMware vCenter Syslog server path traversal leads to RCEVMware vCenter's Syslog server is affected by a directory traversal flaw (CWE-22) that allows a remote, unauthenticated attacker to execute arbitrary…KEVEPSS 2.6%analysed10.0CVE-2026-48282Adobe ColdFusion path traversal leads to remote code executionColdFusion versions 2025.9, 2023.20 and earlier contain a path traversal flaw (CWE-22) that allows an unauthenticated remote attacker to reach files …KEVEPSS 42%analysed

Source: NIST National Vulnerability Database (record CVE-2015-7888), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.