CVE-2024-20827 Auth bypass in Gallery

Medium 4.6 Published 6 Feb 2024 Updated 1 Aug 2024

Physical attackers can bypass lockscreen restrictions to view gallery images using a physical keyboard on Samsung Gallery.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-20827?

CVE-2024-20827 is a medium-severity authentication bypass vulnerability in Samsung Mobile Gallery, published on 6 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Improper access control vulnerability in Samsung Gallery prior to version 14.5.04.4 allows physical attackers to access the picture using physical keyboard on the lockscreen.

Which versions are affected by CVE-2024-20827?

It affects 1 product.

Products include Samsung Gallery.

How do I fix CVE-2024-20827?

No fix has been published for CVE-2024-20827 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-20827 being exploited?

There is no known exploitation of CVE-2024-20827 in the wild and no public exploit code.

Sources

Also known as GHSA-8vw5-wvh5-q977.