CVE-2022-27841 Auth bypass in Samsung Pass
A physical attacker can bypass authentication to view previously running screens in Samsung Pass due to improper exception handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-27841?
CVE-2022-27841 is a medium-severity authentication bypass vulnerability in Samsung Pass, published on 11 Apr 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Improper exception handling in Samsung Pass prior to version 3.7.07.5 allows physical attacker to view the screen that is previously running without authentication
Which versions are affected by CVE-2022-27841?
It affects 1 product.
Products include Samsung Samsung Pass.
How do I fix CVE-2022-27841?
No fix has been published for CVE-2022-27841 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-27841 being exploited?
There is no known exploitation of CVE-2022-27841 in the wild and no public exploit code.
Other vulnerabilities in Samsung Pass
- CVE-2022-30730 Missing authorization in Samsung Pass
- CVE-2022-36851 Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a
- CVE-2021-25505 Auth bypass in Samsung Pass
- CVE-2022-36876 Missing authorization in Samsung Pass
Sources
Also known as GHSA-xxq8-w68p-wqxp.