Samsung · Mobile Devices

CVE-2021-25489

Samsung Mobile Devices Improper Input Validation Vulnerability

Exploited in attacks Low 3.3 Attack chance: 0.5%

What it is

Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.

CISA: Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.

What to do

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

Deadline for US federal agencies: July 20, 2023

Added to the CISA list: June 29, 2023
Published: October 6, 2021
Severity: Low 3.3 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 0.5% in the top 55.3% of all known vulnerabilities
Weakness: CWE-20
More details: NVD · CVE.org · CISA

All references (1)

https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10

More exploited flaws from Samsung

Added	Vulnerability	Product	Severity	Attack chance
Nov 10, 2025	Out-of-Bounds WriteCVE-2025-21042	Mobile Devices	High 8.8	36%
Oct 2, 2025	Out-of-Bounds WriteCVE-2025-21043	Mobile Devices	High 8.8	2.2%
Sep 18, 2023	Use-After-FreeCVE-2022-22265	Mobile Devices	Medium 5.0	0.4%
Jun 29, 2023	UnspecifiedCVE-2021-25371	Mobile Devices	Medium 6.1	0.8%
Jun 29, 2023	Improper Boundary CheckCVE-2021-25372	Mobile Devices	Medium 6.1	0.8%
Jun 29, 2023	Race ConditionCVE-2021-25394	Mobile Devices	Medium 6.4	0.4%
Jun 29, 2023	Race ConditionCVE-2021-25395	Mobile Devices	Medium 6.4	0.4%
Jun 29, 2023	Out-of-Bounds ReadCVE-2021-25487	Mobile Devices	High 7.3	0.6%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.