Path traversal in Samsung Mobile Firmware - CVE-2024-20804
Published: January 8, 2024
Vulnerability identifier: #VU85080
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-20804
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to overwrite arbitrary files on the system.
The vulnerability exists due to input validation error when processing directory traversal sequences in FileUriConverter of MyFiles. A remote attacker can trick the victim to open a specially crafted archive and overwrite arbitrary files on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
Affected software
Samsung Mobile Firmware
How to mitigate CVE-2024-20804
Install update from vendor's website.
Samsung Mobile Firmware - update to SMR-JAN-2024