CVE-2025-21080

Q: What is the severity of CVE-2025-21080?

CVE-2025-21080 has a CVSS score of 6.2 (MEDIUM). This vulnerability in Samsung's Dynamic Lockscreen allows local attackers to improperly access files with the application's elevated privileges. It affects Samsung Android devices with vulnerable Dynamic Lockscreen versions. Attackers must have local access to the device to exploit this flaw.

6.2 MEDIUM

📋 TL;DR

This vulnerability in Samsung's Dynamic Lockscreen allows local attackers to improperly access files with the application's elevated privileges. It affects Samsung Android devices with vulnerable Dynamic Lockscreen versions. Attackers must have local access to the device to exploit this flaw.

💻 Affected Systems

Products:

Samsung Dynamic Lockscreen

Versions: All versions prior to SMR Dec-2025 Release 1

Operating Systems: Android (Samsung devices)

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects Samsung devices with Dynamic Lockscreen installed. The vulnerability is in the application component export mechanism.

📦 What is this software?

Android by Samsung

Android is Google's open-source mobile operating system powering over 3 billion devices worldwide, including smartphones, tablets, smart TVs, automotive systems, wearables, and IoT devices. As the world's dominant mobile OS with approximately 72% global market share, Android serves as the foundation...

Learn more about Android →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local attackers could access sensitive files stored by Dynamic Lockscreen, potentially including user data, configuration files, or other protected content that should only be accessible to the application itself.

🟠

Likely Case

Local users or malicious apps could read files from Dynamic Lockscreen's data directory, potentially exposing user preferences, cached content, or other application-specific data.

🟢

If Mitigated

With proper Android sandboxing and file permission controls, the impact would be limited to files specifically accessible to Dynamic Lockscreen, preventing system-wide access.

🌐 Internet-Facing: LOW - This is a local privilege escalation vulnerability requiring physical or local access to the device.

🏢 Internal Only: MEDIUM - In enterprise environments, malicious insiders or compromised devices could exploit this to access Dynamic Lockscreen data.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access to the device. The vulnerability involves improper component export, which typically allows other apps to interact with vulnerable components.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: SMR Dec-2025 Release 1

Vendor Advisory: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12

Restart Required: Yes

Instructions:

1. Check for system updates in Settings > Software update > Download and install. 2. Install the December 2025 security maintenance release (SMR). 3. Restart the device after installation completes.

🔧 Temporary Workarounds

Disable Dynamic Lockscreen

android

Temporarily disable the vulnerable Dynamic Lockscreen feature until patched

Restrict app installations

android

Prevent installation of untrusted applications that could exploit this vulnerability

🧯 If You Can't Patch

Disable Dynamic Lockscreen feature in device settings
Implement device management policies to restrict app installations and monitor for suspicious activity

🔍 How to Verify

Check if Vulnerable:

Check Dynamic Lockscreen version in Settings > Apps > Dynamic Lockscreen > App info. If version is prior to December 2025 update, device is vulnerable.

Check Version:

Settings > About phone > Software information > Android security patch level

Verify Fix Applied:

Verify Android security patch level is December 2025 or later in Settings > About phone > Software information > Android security patch level.

📡 Detection & Monitoring

Log Indicators:

Unauthorized access attempts to Dynamic Lockscreen components
Permission violations in Android system logs

Network Indicators:

No network indicators - this is a local vulnerability

SIEM Query:

Look for Android security events related to component access violations or permission bypass attempts

📊 Metadata

CVE ID: CVE-2025-21080

CVSS v3 Score: 6.2 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Score: 0.02% exploit probability (3.9th percentile)

Published: December 2, 2025

Last Updated: December 5, 2025

🔗 References

https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12 Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

Android by Samsung

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable Dynamic Lockscreen

Restrict app installations

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export