CVE-2025-20951
📋 TL;DR
This vulnerability in Galaxy Store allows local attackers to write arbitrary files with Galaxy Store's privileges due to improper intent verification by a broadcast receiver. It affects Samsung Galaxy devices running vulnerable versions of Galaxy Store. Attackers must have local access to the device to exploit this.
💻 Affected Systems
- Samsung Galaxy Store
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could write malicious files to sensitive locations, potentially leading to privilege escalation, data corruption, or installation of malware with Galaxy Store's permissions.
Likely Case
Local attackers could modify application data, inject malicious content, or disrupt normal Galaxy Store operations.
If Mitigated
With proper access controls and updated software, the risk is limited to authorized users with device access attempting file manipulation.
🎯 Exploit Status
Exploitation requires local access to the device and knowledge of broadcast receiver vulnerabilities. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.90.7
Vendor Advisory: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=04
Restart Required: No
Instructions:
1. Open Galaxy Store app. 2. Go to Settings > About Galaxy Store. 3. Check version. 4. If below 4.5.90.7, update via Galaxy Store updates or Samsung app store. 5. Verify update completed successfully.
🔧 Temporary Workarounds
Disable Galaxy Store
androidTemporarily disable Galaxy Store to prevent exploitation until patched
adb shell pm disable-user --user 0 com.sec.android.app.samsungapps
Restrict Broadcast Receivers
androidConfigure Android to restrict broadcast intents to Galaxy Store
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local device access
- Monitor for suspicious file write activities in Galaxy Store directories
🔍 How to Verify
Check if Vulnerable:
Check Galaxy Store version in app settings. If version is below 4.5.90.7, the device is vulnerable.Check Version:
adb shell dumpsys package com.sec.android.app.samsungapps | grep versionNameVerify Fix Applied:
Confirm Galaxy Store version is 4.5.90.7 or higher in app settings.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations by Galaxy Store process
- Broadcast intents to Galaxy Store with file manipulation payloads
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
process_name:"Galaxy Store" AND file_write_operation AND destination_path NOT IN [expected_paths]