Members
CVE-2025-20949
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Members.
AnalysisAI
Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Members. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Members. Affected products include: Samsung Members. Version information: version 5.0.00.11.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.
Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.
An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in
Samsung Members versions prior to 15.5.05.4 contain a path traversal vulnerability that enables local attackers to overw
Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity. R
Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across
Members versions up to 5.6.00.11 contains a vulnerability that allows attackers to connect arbitrary URL and launch arbi
Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive
Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute cal
Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.
Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.
Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of servi
Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today