Samsung Pass
CVE-2022-36876
LOW
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication.
AnalysisAI
Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication. Rated low severity (CVSS 2.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-285. Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication. Affected products include: Samsung Samsung Pass. Version information: version 4.0.04.10.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Samsung Pass
View allImproper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is un
Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data
Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authen
Improper exception handling in Samsung Pass prior to version 3.7.07.5 allows physical attacker to view the screen that i
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today