CVE-2025-21035

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21035
Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data across multiple user profiles.

4.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
History

29 Sep 2025, 18:23

Type Values Removed Values Added
First Time Google
Google android
Samsung
Samsung calendar
References () https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09 - () https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09 - Vendor Advisory
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
cpe:2.3:a:samsung:calendar:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*

03 Sep 2025, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-03 06:15

Updated : 2025-09-29 18:23

NVD link : CVE-2025-21035

Mitre link : CVE-2025-21035

CVE.ORG link : CVE-2025-21035

JSON object : View

Products Affected

samsung

  • calendar

google

  • android
CWE
NVD-CWE-noinfo