Is CVE-2021-25487 actively exploited?

Yes. CVE-2021-25487 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2021-25487 be exploited remotely?

The attack vector of CVE-2021-25487 has not been classified yet.

What is the CVSS score of CVE-2021-25487?

CVE-2021-25487 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2021-25487

HIGHCISA KEVIN THE WILD

CVE-2021-25487

Published: June 29, 2023

EPSS:2.37%probability of exploitation in 30 daysPercentile:84.7th

Official Description

Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.

NVD Source

CISA KEV Advisory

Samsung Mobile Devices Out-of-Bounds Read Vulnerability

Added to KEV: 2023-06-29Federal patch deadline: 2023-07-20

Required Action (CISA)

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable

Risk Analysis

This high-severity vulnerability in Samsung mobile devices' modem interface driver involves an out-of-bounds read, which can lead to remote code execution. Its inclusion in CISA's KEV catalog indicates confirmed exploitation in the wild, making immediate action necessary.

Active exploitation of this vulnerability has been observed in the wild, and it is listed in CISA's Known Exploited Vulnerabilities catalog.

Recommended Action

Update Samsung mobile devices to the latest available firmware and security patches to address the modem interface driver vulnerability.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2021-25487 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2021-25487 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.