← Vulnerability feed

Vulnerability record · CVE-2021-25489 · published 6 October 2021

CVE-2021-25489: Samsung Android modem driver format string bug causes kernel panic

Samsung · Android

Samsung Android devices contain a missing input validation flaw in the modem interface driver, resulting in a format string bug. It is listed in CISA KEV, so it has been exploited in the wild despite a medium CVSS score.

5.5 CVSS 3.1 Medium CISA KEV since 29 Jun 2023 EPSS 0.53% · top 57.4% CWE-20 · Improper input validationCWE-134 · CWE-134
5.5CVSS 3.1 base score, v2 4.9
0.53%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed exploitation, but impact is limited to local denial of service requiring prior radio permission.

What it is

Samsung Android devices contain a missing input validation flaw in the modem interface driver, resulting in a format string bug. It is listed in CISA KEV, so it has been exploited in the wild despite a medium CVSS score.

Impact

An attacker who already holds radio permission can trigger a kernel panic, causing a denial of service on the device. There is no confidentiality or integrity impact per the CVSS vector.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have radio permission on the device. It is not remotely reachable without that local access.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2023-06-29, confirming real-world exploitation. EPSS is low at 0.00531 (43.5th percentile), and no ransomware use is documented.

What to do

  • Apply the Samsung SMR Oct-2021 Release 1 or later update to affected devices.
  • If updates are unavailable, discontinue use of the affected product per CISA guidance.
  • Restrict or monitor apps and processes granted radio permission.
  • Track device patch levels and enforce minimum security patch versions.

Detection

  • Monitor for kernel panic events and unexpected device reboots on Samsung Android devices.
  • Audit which apps hold radio permission and alert on unusual grants.
  • Correlate device crash logs with modem interface driver activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2021-25489 to the Known Exploited Vulnerabilities catalog on 29 June 2023 as "Samsung Mobile Devices Improper Input Validation Vulnerability". Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable Federal deadline 20 July 2023.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10 Vendor Advisory
https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25489 US Government Resource

Track CVE-2021-25489 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-21042Samsung Android libimagecodec.quram.so out-of-bounds writeAn out-of-bounds write in Samsung's libimagecodec.quram.so image codec library, fixed in the SMR Apr-2025 Release 1, allows remote attackers to execu…KEVEPSS 33%analysed9.8CVE-2025-21043Samsung Android libimagecodec Out-of-Bounds Write RCEAn out-of-bounds write in libimagecodec.quram.so, a Samsung image codec library on Android, allows remote code execution. The flaw is reachable witho…KEVEPSS 2.1%analysed7.8CVE-2021-25487Samsung Android modem driver buffer bounds flaw enables code executionThe modem interface driver in Samsung Android fails to bounds-check a buffer in set_skb_priv(), allowing an out-of-bounds read. The read can derefere…KEVEPSS 0.64%analysed7.1CVE-2021-25337Samsung clipboard service access control flaw exposes local filesSamsung mobile devices before SMR Mar-2021 Release 1 have improper access control in the clipboard service, letting untrusted applications read or wr…KEVEPSS 2.8%analysed6.7CVE-2021-25371Samsung Android DSP driver allows loading arbitrary ELF librariesThe DSP driver in Samsung Android devices before SMR Mar-2021 Release 1 permits loading of arbitrary ELF libraries inside the DSP. This breaks the in…KEVEPSS 0.80%analysed6.7CVE-2021-25372Samsung Android DSP driver improper boundary check allows out-of-bounds memory accessThe Samsung DSP driver in Android contains an improper boundary check that permits out-of-bounds memory access. The flaw is fixed in SMR Mar-2021 Rel…KEVEPSS 0.80%analysed6.4CVE-2021-25395Samsung Android MFC charger driver race condition bypasses signature checkA race condition in the Samsung MFC charger driver, fixed prior to SMR MAY-2021 Release 1, lets a local attacker bypass a signature check. It matters…KEVEPSS 0.37%analysed6.4CVE-2021-25394Samsung Android MFC charger driver use-after-free via race conditionThe MFC charger driver in Samsung Android contains a use-after-free that can be triggered through a race condition. It allows an arbitrary write, but…KEVEPSS 0.40%analysed

Source: NIST National Vulnerability Database (record CVE-2021-25489), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.