CVE-2025-20903
Published: 06 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-20903 is an improper access control vulnerability affecting the SecSettingsIntelligence component prior to SMR Mar-2025 Release 1. This issue enables local attackers to launch privileged activities, with user interaction required to trigger the vulnerability. The flaw carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE information not available from NVD.
A local attacker with low privileges can exploit this vulnerability by leveraging low attack complexity and inducing user interaction, such as clicking a malicious link or confirming an action. Successful exploitation allows the attacker to execute privileged activities, potentially compromising high levels of confidentiality, integrity, and availability on the affected device.
Samsung's security bulletin for March 2025, available at https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=03, details the vulnerability and recommends updating to SMR Mar-2025 Release 1 or later to mitigate the issue.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The improper access control vulnerability directly enables local attackers to launch privileged activities, mapping to Exploitation for Privilege Escalation (T1068).