---
id: "CVE-2021-25337"
kind: "vulnerability"
aliases: ["CVE-2021-25337"]
title: "samsung android: Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows\u2026"
severity: "high"
cvss: 7.1
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Samsung Mobile Devices", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "samsung android", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "samsung android", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "samsung android", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["android", "exploited", "mobile-fleet", "samsung", "vendor"]
not_affected_if: ["non-samsung-devices"]
published_at: "2021-03-04T21:15:13+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-25337", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25337", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# samsung android: Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows…

Samsung mobile devices have an improper access control flaw in the clipboard service that lets untrusted apps read or write arbitrary files. It was chained with CVE-2021-25369 and CVE-2021-25370, and CISA lists it as exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Samsung Mobile Devices affected ? fixed ?
- vendor:samsung android affected = 9.0 fixed ?
- vendor:samsung android affected = 10.0 fixed ?
- vendor:samsung android affected = 11.0 fixed ?

## How to check

Settings > Software update > check the security patch level on each Samsung device; unknown whether the sources give a specific build number.

## Fix

Apply the Samsung security update for your device model per vendor instructions; the sources do not name a specific patched version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-25337
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-25337

## From the sources

Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_