CVE-2021-25509 Path traversal in Samsung Flow

Medium 5.9 Published 5 Nov 2021 Updated 3 Aug 2024

Attackers can overwrite files in Windows known folders due to missing input validation in the Samsung Flow Windows application.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-25509?

CVE-2021-25509 is a medium-severity path traversal vulnerability in Samsung Flow, published on 5 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the Windows known folders.

Weakness: CWE-20

Which versions are affected by CVE-2021-25509?

It affects 1 product.

Products include Samsung Samsung Flow.

How do I fix CVE-2021-25509?

No fix has been published for CVE-2021-25509 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-25509 being exploited?

There is no known exploitation of CVE-2021-25509 in the wild and no public exploit code.

Sources

Also known as GHSA-cm79-7q92-x7r9.