Chamada de um provedor inexistente no Samsung Members anterior à versão 2.4.81.13 (no Android O(8.1) e abaixo) e 3.8.00.13 (no Android P(9.0) e superior) permite ações não autorizadas incluindo negação de

An attacker exploiting CVE-2021-25343 can induce a denial-of-service condition on a target device running the vulnerable Samsung Members application. By hijacking the provider, the attacker can potentially disrupt the normal operation of the app, preventing legitimate users from accessing its features. While the description doesn't detail specific data at risk, the ability to trigger unauthorized actions suggests potential for further exploitation and privilege escalation within the device's ecosystem. The blast radius is limited to the affected device, but widespread deployment of the Samsung Members app increases the overall potential impact.

Users of Samsung devices running Android O (8.1) and below, and those running Android P (9.0) and above with versions of the Samsung Members app prior to 3.8.00.13 are at risk. This includes users who have not enabled automatic app updates or who are using older, unsupported devices.

• android / app:

# Check for vulnerable Samsung Members versions
Get-InstalledPackage -Name "Samsung Members" | Select-Object Version | Where-Object { $_ -le "3.8.00.13" }

• android / app:

# Check app permissions (may require root access)
adb shell pm list permissions -f com.samsung.android.members

• android / system:

# Check system logs for errors related to provider calls
logcat -s "ActivityManager" | grep "ProviderNotFoundException"

1. 2021-03-04Disclosure

   disclosure

1. Reservado2021-01-19
2. Publicada2021-03-04
3. Modificada2024-08-03
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2021-25343 is to upgrade the Samsung Members application to version 3.8.00.13 or later. This version includes the necessary fix to prevent the calling of the non-existent provider. There are no immediate workarounds beyond ensuring users are running the latest available version of the app. Consider implementing mobile device management (MDM) policies to enforce app updates and prevent the installation of older, vulnerable versions. After upgrading, confirm the fix by attempting to trigger the vulnerable action (e.g., initiating a provider call) and verifying that it no longer results in an error or unauthorized behavior.