{"id":"CVE-2021-25394","kind":"vulnerability","aliases":["CVE-2021-25394"],"related":[],"title":"samsung android: A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows…","description":"Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.\n\nCISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","summary":"A race condition in the MFC charger driver on Samsung mobile devices causes a use-after-free that allows a write to memory. The attacker must already hold a compromised radio privilege, and CISA lists it as exploited in the wild.","severity":"high","cvss":6.4,"epss":null,"exploited":true,"exploited_at":"2023-06-29T00:00:00+00:00","products":[{"name":"Samsung Mobile Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 8.1","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"samsung android","fixed":[],"affected":"= 11.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","infrastructure","mobile-devices","samsung"],"not_affected_if":["patched-device"],"how_to_check":null,"fix":"Apply the Samsung security update for the device per vendor instructions, or discontinue use of affected devices if no update is available.","status":"open","published_at":"2021-06-11T15:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:24+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:06:24Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Samsung security update for the device per vendor instructions, or discontinue use of affected devices if no update is available.","reach":"local","impact":"high","summary":"A race condition in the MFC charger driver on Samsung mobile devices causes a use-after-free that allows a write to memory. The attacker must already hold a compromised radio privilege, and CISA lists it as exploited in the wild.","category":"infrastructure","who_cares":["samsung","android","mobile-devices"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker writes kernel memory after compromising the radio component, enabling device takeover.","analyst_note":"Find the Samsung security bulletin listing the patched Android security patch level for CVE-2021-25394 and the affected device models.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-device"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000453,"input_tokens":2817,"output_tokens":343,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':19A,24A,27A '-25394':25A,28A '1':21A 'action':122C 'allow':22A,66B,110C 'alreadi':74B 'android':2A,33A,35A,37A,39A,40B 'appli':123C 'attack':72B 'caus':59B 'charger':13A,53B,100C 'cisa':81B,120C 'compromis':77B,119C 'condit':10A,49B,95C 'contain':92C 'cve':23A,26A 'devic':45B,58B,91C 'devices':31A 'discontinu':129C 'driver':14A,54B,101C 'exploit':41B,85B 'free':6A,64B,109C 'given':114C 'hold':75B 'infrastructur':42B 'instruct':127C 'lead':103C 'list':82B 'may':18A 'memori':70B 'mfc':12A,52B,99C 'mobil':44B,57B,90C 'mobile':30A 'mobile-devic':43B 'must':73B 'per':125C 'prior':15A 'privileg':79B,117C 'product':133C 'race':9A,48B,94C 'radio':78B,116C 'releas':20A 'requir':121C 'samsung':1A,29A,32A,34A,36A,38A,46B,56B,89C 'smr':17A 'unavail':137C 'updat':124C,135C 'use':4A,62B,107C,130C 'use-after-fre':61B,106C 'vendor':126C 'via':8A 'vulner':7A,96C 'wild':88B 'within':97C 'write':68B,113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-06-11T15:15:08+00:00","kev":{"dateAdded":"2023-06-29","dueDate":"2023-07-20","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"mobile.security@samsung.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-25394","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-25394","severity":null,"published_at":"2023-06-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-25394","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25394","severity":null,"published_at":"2021-06-11T15:15:08+00:00","modified_at":"2026-06-17T03:42:00+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}