Samsung Smartthings vulnerabilities
20 vulnerabilities
Known vulnerabilities in Samsung Smartthings, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-25378samsung mobilesmartthings+1
EPSS score0.97%
Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service.CVE-2021-25447samsung mobilesmart things+1EPSS score0.79%
Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview.CVE-2021-25404samsung mobilesmartthings+1EPSS score0.24%
Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log.CVE-2021-25446samsung mobilesmart things+1EPSS score0.81%
Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview.CVE-2021-25508samsung mobilesmartthings+1EPSS score0.83%
Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation.CVE-2025-2233samsungsmartthingsEPSS score0.77%
Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Samsung SmartThings. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the Hub Local API service, which listens on TCP port 8766 by default. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25615.CVE-2022-39868samsung mobilesmartthings+1EPSS score0.41%
Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.CVE-2022-39870samsung mobilesmartthings+1EPSS score0.41%
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via PUSH_MESSAGE_RECEIVED broadcast.CVE-2022-39867samsung mobilesmartthings+1EPSS score0.41%
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via SHOW_PERSISTENT_BANNER broadcast.CVE-2022-39864samsung mobilesmartthings+1EPSS score0.39%
Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via implicit intent.CVE-2022-39866samsung mobilesmartthings+1EPSS score0.41%
Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.CVE-2022-39869samsung mobilesmartthings+1EPSS score0.41%
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via REMOVE_PERSISTENT_BANNER broadcast.CVE-2022-39865samsung mobilesmartthings+1EPSS score0.41%
Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.CVE-2022-39871samsung mobilesmartthings+1EPSS score0.41%
Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcasts.CVE-2022-30746samsung mobilesmart things+1EPSS score0.89%
Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API.CVE-2022-30747samsung mobilesmart things+1EPSS score0.19%
PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent.CVE-2022-30749samsung mobilesmart things+1EPSS score0.18%
Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity.CVE-2024-20852samsungsmartthingsEPSS score0.14%
Improper verification of intent by broadcast receiver vulnerability in SmartThings prior to version 1.8.13.22 allows local attackers to access testing configuration.CVE-2024-49416samsungsmartthingsEPSS score0.13%
Use of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows local attackers to get sensitive information.CVE-2024-34596samsungsmartthingsEPSS score0.48%
Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner.