CVE-2016-4032: samsung galaxy_note_3_firmware Improper Access Control
Vulnerability summary
CVE-2016-4032 is a medium (CVSS 4.6) Improper Access Control vulnerability in samsung galaxy_note_3_firmware. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 13-04-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini), GT-I9195 build I9195XXUCOL1 (Galaxy S4 mini LTE), and GT-I9505 build I9505XXUHOJ2 (Galaxy S4) devices do not block AT+USBDEBUG and AT+WIFIVALUE, which allows attackers to modify Android settings by leveraging AT access, aka SVE-2016-5301.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAdvisories
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Samsung5 products
- galaxy_note_3_firmwaren9005xxugbob6
- galaxy_s4_firmwarei9505xxuhoj2
- galaxy_s4_mini_firmwarei9192xxubnb1
- galaxy_s4_mini_lte_firmwarei9195xxucol1
- galaxy_s6g920fxxu2coh2
1 vendor · 5 products
References
2 links- github.com/ud2/advisories/tree/master/android/samsung/nocve-2016-0004X Refsource MISCExploitTechnical DescriptionThird Party Advisory