CVE-2025-20898
📋 TL;DR
This vulnerability in Samsung Members app allows physical attackers to bypass user profile isolation and access data from other user profiles on the same device. It affects Samsung devices with multiple user profiles configured. The attack requires physical access to the device.
💻 Affected Systems
- Samsung Members app
📦 What is this software?
Members by Samsung
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access could access sensitive personal data, authentication tokens, or private files from other user profiles on the same device, potentially leading to identity theft or data breach.
Likely Case
Limited data exposure from other user profiles on shared or lost/stolen devices, potentially exposing personal information, messages, or app data.
If Mitigated
With proper device security controls (screen locks, encryption), the impact is reduced as physical access would still require authentication bypass.
🎯 Exploit Status
Requires physical access to the device and knowledge of the vulnerability. No public exploit details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.00.12
Vendor Advisory: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=01
Restart Required: No
Instructions:
1. Open Google Play Store on Samsung device. 2. Search for 'Samsung Members'. 3. Update to version 5.2.00.12 or later. 4. Alternatively, update through Samsung Galaxy Store if available.
🔧 Temporary Workarounds
Disable Samsung Members app
androidTemporarily disable the vulnerable app until patched
adb shell pm disable-user --user 0 com.samsung.android.voc
Remove user profiles
androidRemove additional user profiles to eliminate attack surface
Settings > Users & accounts > Users > Remove user
🧯 If You Can't Patch
- Implement strong device authentication (PIN/pattern/password/biometric) to prevent unauthorized physical access
- Disable or restrict Samsung Members app permissions in device settings
🔍 How to Verify
Check if Vulnerable:
Check Samsung Members app version in device settings: Settings > Apps > Samsung Members > App infoCheck Version:
adb shell dumpsys package com.samsung.android.voc | grep versionNameVerify Fix Applied:
Confirm Samsung Members app version is 5.2.00.12 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to Samsung Members app
- Multiple user profile switching in short time
Network Indicators:
- None - local vulnerability only
SIEM Query:
app:Samsung_Members AND (event:profile_switch OR event:permission_escalation)