CVE-2024-49405
📋 TL;DR
This vulnerability in Samsung Pass allows physical attackers to bypass authentication and access sensitive information stored in the Private Info feature. It affects Samsung mobile device users with Samsung Pass versions before 4.4.04.7. The attack requires physical access to the device under specific conditions.
💻 Affected Systems
- Samsung Pass
📦 What is this software?
Pass by Samsung
⚠️ Risk & Real-World Impact
Worst Case
Physical attackers could access stored passwords, payment information, personal notes, and other sensitive data protected by Samsung Pass without authentication.
Likely Case
Someone with brief physical access to an unlocked or recently used device could view sensitive information that should require additional authentication.
If Mitigated
With proper device locking and physical security controls, the risk is significantly reduced as the attack requires specific physical access conditions.
🎯 Exploit Status
Requires physical access and specific conditions. Not remotely exploitable. Samsung has not disclosed exact exploitation details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.04.7 and later
Vendor Advisory: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=11
Restart Required: No
Instructions:
1. Open Samsung Pass app. 2. Check for updates in app settings. 3. Update to version 4.4.04.7 or later. 4. Alternatively, update through Galaxy Store or device system updates.
🔧 Temporary Workarounds
Disable Private Info feature
androidTemporarily disable the Private Info functionality in Samsung Pass until patched
Enable strong device authentication
androidUse biometric authentication (fingerprint/face) and strong PIN/password for device unlock
🧯 If You Can't Patch
- Disable Samsung Pass Private Info feature entirely
- Implement strict physical security controls for devices and ensure they are never left unattended
🔍 How to Verify
Check if Vulnerable:
Check Samsung Pass version in app settings. If version is below 4.4.04.7, device is vulnerable.Check Version:
No CLI command. Check via: Samsung Pass app → Settings → About Samsung PassVerify Fix Applied:
Confirm Samsung Pass version is 4.4.04.7 or higher in app settings.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to Samsung Pass Private Info
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- Not applicable - local physical vulnerability
SIEM Query:
Not applicable for this physical access vulnerability