Summaryinfo

A vulnerability described as critical has been identified in GalaxyWatch4Plugin. Impacted is an unknown function. The manipulation results in access control. This vulnerability is reported as CVE-2022-39889. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Detailsinfo

A vulnerability classified as problematic has been found in GalaxyWatch4Plugin. Affected is an unknown code block. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality. CVE summarizes:

Improper access control vulnerability in GalaxyWatch4Plugin prior to versions 2.2.11.22101351 and 2.2.12.22101351 allows attackers to access wearable device information.

The weakness was disclosed 11/10/2022. The advisory is shared for download at security.samsungmobile.com. This vulnerability is traded as CVE-2022-39889 since 09/05/2022. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 2.2.11.22101351 or 2.2.12.22101351 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• GalaxyWatch4Plugin

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion