{"id":"CVE-2021-25371","kind":"vulnerability","aliases":["CVE-2021-25371"],"related":[],"title":"samsung android: A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP","description":"Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.\n\nCISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","summary":"Samsung mobile devices have an unspecified flaw in the DSP driver that lets an attacker load ELF libraries into the DSP. CISA lists it as actively exploited, so the attacker gets code execution on the digital signal processor.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2023-06-29T00:00:00+00:00","products":[{"name":"Samsung Mobile Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 11.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices","samsung"],"not_affected_if":["fully-patched-devices","non-samsung-devices"],"how_to_check":"Check the device's security patch level in Settings > About phone > Software information; compare it with Samsung's bulletin for the version. unknown for a specific file or setting.","fix":"Apply the Samsung security update for the device per vendor instructions; if no update exists, stop using the device (per CISA required action).","status":"open","published_at":"2021-03-26T19:15:12+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:25+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:06:25Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Samsung security update for the device per vendor instructions; if no update exists, stop using the device (per CISA required action).","reach":"unknown","impact":"high","summary":"Samsung mobile devices have an unspecified flaw in the DSP driver that lets an attacker load ELF libraries into the DSP. CISA lists it as actively exploited, so the attacker gets code execution on the digital signal processor.","category":"infrastructure","who_cares":["samsung","android","mobile-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs native code on the DSP, possibly escalating from there","analyst_note":"Find Samsung's bulletin for CVE-2021-25371 to get affected and fixed Android/firmware versions and the patched patch-level date.","how_to_check":"Check the device's security patch level in Settings > About phone > Software information; compare it with Samsung's bulletin for the version. unknown for a specific file or setting.","needs_analyst":true,"not_affected_if":["non-samsung-devices","fully-patched-devices"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000488,"input_tokens":2807,"output_tokens":415,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':12A,24A,27A '-25371':25A,28A '1':14A 'action':102C 'activ':68B 'allow':15A,92C 'android':2A,33A,35A,36B 'appli':103C 'arbitrari':18A 'attack':16A,57B,72B,93C 'cisa':64B,100C 'code':74B 'contain':84C 'cve':23A,26A 'devic':41B,45B,83C 'devices':31A 'digit':78B 'discontinu':109C 'driver':7A,53B,90C 'dsp':6A,22A,52B,63B,89C,99C 'elf':19A,59B,96C 'execut':75B 'exploit':37B,69B 'flaw':49B 'get':73B 'infrastructur':38B 'insid':21A,98C 'instruct':107C 'let':55B 'librari':20A,60B,97C 'list':65B 'load':17A,58B,95C 'mar':11A 'mobil':40B,44B,82C 'mobile':30A 'mobile-devic':39B 'per':105C 'prior':8A 'processor':80B 'product':113C 'releas':13A 'requir':101C 'samsung':1A,29A,32A,34A,42B,43B,81C 'signal':79B 'smr':10A 'unavail':117C 'unspecifi':48B,86C 'updat':104C,115C 'use':110C 'vendor':106C 'vulner':4A,87C 'within':88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-03-26T19:15:12+00:00","kev":{"dateAdded":"2023-06-29","dueDate":"2023-07-20","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"mobile.security@samsung.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-25371","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-25371","severity":null,"published_at":"2023-06-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-25371","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25371","severity":null,"published_at":"2021-03-26T19:15:12+00:00","modified_at":"2026-06-17T03:41:57+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}