SB2024030520 - Multiple vulnerabilities in Samsung Voice Recorder

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024030520

SB2024030520 - Multiple vulnerabilities in Samsung Voice Recorder

Published: March 5, 2024

Security Bulletin ID SB2024030520
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Physical access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2024-20839)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. An attacker with physical access can access recording files on the lock screen.


2) Improper access control (CVE-ID: CVE-2024-20840)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. An attacker with physical access can use hardware keyboard to use VoiceRecorder on the lock screen.


Remediation

Install update from vendor's website.

References