{"id":"CVE-2026-125715","kind":"vulnerability","aliases":["CVE-2026-125715"],"related":[],"title":"Samsung mTower: apps can open trusted-execution sessions without access checks","description":"Samsung mTower lacks access control for TA sessions, allowing a Normal World application to open TA sessions and invoke their commands, or use a close existing sessions if thier identifiers are known, The impact depends on the affected TA.","summary":"Samsung mTower, the TEE component on Samsung devices, does not check access for trusted application (TA) sessions. A normal-world app can open sessions, invoke their commands, or close existing sessions when it knows their identifiers, and the impact depends on the affected TA.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mtower","samsung","trusted-execution"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T12:17:18+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:44+00:00","updated_at":"2026-11-10T12:22:44+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T12:22:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Samsung mTower: apps can open trusted-execution sessions without access checks","impact":"medium","summary":"Samsung mTower, the TEE component on Samsung devices, does not check access for trusted application (TA) sessions. A normal-world app can open sessions, invoke their commands, or close existing sessions when it knows their identifiers, and the impact depends on the affected TA.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["samsung","android","mtower","trusted-execution"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"A local app may invoke or close secure trusted-app sessions","analyst_note":"Find affected Samsung firmware versions and the Samsung security bulletin fix details from the linked patch page.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affects Samsung devices running the mTower trusted execution environment; the sources do not list affected models or firmware versions. The impact depends on which trusted applications are installed. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":4537,"output_tokens":432,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125715':15A,18A '-2026':14A,17A 'access':11A,37B,74C 'affect':69B,108C 'allow':79C 'android':19B 'app':3A,47B 'applic':40B,83C 'check':12A,36B 'close':55B,95C 'command':53B,91C 'compon':30B 'control':75C 'cve':13A,16A 'depend':66B,105C 'devic':33B 'execut':8A,25B 'exist':56B,96C 'identifi':62B,100C 'impact':65B,104C 'infrastructur':20B 'invok':51B,89C 'know':60B 'known':102C 'lack':73C 'mtower':2A,21B,27B,72C 'normal':45B,81C 'normal-world':44B 'open':5A,49B,85C 'samsung':1A,22B,26B,32B,71C 'session':9A,42B,50B,57B,78C,87C,97C 'ta':41B,70B,77C,86C,109C 'tee':29B 'thier':99C 'trust':7A,24B,39B 'trusted-execut':6A,23B 'use':93C 'without':10A 'world':46B,82C","nicknames":[],"mitigations":[],"who_affected":"Affects Samsung devices running the mTower trusted execution environment; the sources do not list affected models or firmware versions. The impact depends on which trusted applications are installed. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","medium","mtower","samsung","trustedexecution"],"campaign_type":null,"search_a":"'-125715':15A,18A '-2026':14A,17A 'access':11A 'app':3A 'check':12A 'cve':13A,16A 'execut':8A 'mtower':2A 'open':5A 'samsung':1A 'session':9A 'trust':7A 'trusted-execut':6A 'without':10A","search_b":"'access':37B 'affect':69B 'android':19B 'app':47B 'applic':40B 'check':36B 'close':55B 'command':53B 'compon':30B 'depend':66B 'devic':33B 'execut':25B 'exist':56B 'identifi':62B 'impact':65B 'infrastructur':20B 'invok':51B 'know':60B 'mtower':21B,27B 'normal':45B 'normal-world':44B 'open':49B 'samsung':22B,26B,32B 'session':42B,50B,57B 'ta':41B,70B 'tee':29B 'trust':24B,39B 'trusted-execut':23B 'world':46B","search_c":"'access':74C 'affect':108C 'allow':79C 'applic':83C 'close':95C 'command':91C 'control':75C 'depend':105C 'exist':96C 'identifi':100C 'impact':104C 'invok':89C 'known':102C 'lack':73C 'mtower':72C 'normal':81C 'open':85C 'samsung':71C 'session':78C,87C,97C 'ta':77C,86C,109C 'thier':99C 'use':93C 'world':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"PSIRT@samsung.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125715","severity":null,"published_at":"2026-11-10T12:17:18+00:00","modified_at":"2026-11-10T12:17:18+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null}],"documents":[{"id":114869,"url":"https://github.com/Samsung/mTower/commit/97070d65ac63713b188b6e2d6bb7076d95100429","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}