Path traversal in Samsung Mobile Firmware - CVE-2024-20805
Published: January 8, 2024
Vulnerability identifier: #VU85079
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-20805
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to overwrite arbitrary files on the system.
The vulnerability exists due to input validation error when processing directory traversal sequences in ZipCompressor of MyFiles. A remote attacker can trick the victim to open a specially crafted archive and overwrite arbitrary files on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
Affected software
Samsung Mobile Firmware
How to mitigate CVE-2024-20805
Install update from vendor's website.
Samsung Mobile Firmware - update to SMR-JAN-2024