Samsung Health
CVE-2025-21059
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or run malicious local app
-
ExploitInvoke Samsung Health interface lacking authorization check
-
ImpactRead protected health data
Vulnerability Assessment
| Exploitation Conditions | Requires local access to the device with at least low-level privileges (PR:L) - in practice a malicious or compromised app already installed and running on the same Samsung device - exploiting Samsung Health versions prior to 6.30.5.105. Exploitation is strongly limited by the need for a pre-existing local foothold: there is no remote or network vector (AV:L) and no user interaction path for a remote attacker, so a victim must already be running attacker-controlled code locally. Impact is limited to reading Samsung Health data (C:H); no data modification or denial of service is possible (I:N/A:N). |
| Impact | This is a genuine but low-urgency issue - a moderate-severity local information disclosure, not a widespread remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is internally consistent with the description: an improper authorization flaw that requires local access and some existing privilege (PR:L, i.e. a malicious or unprivileged app already present on the device) to read Samsung Health data, with no integrity or availability impact. The EPSS score is very low (0.12%, 2nd percentile), there is no CISA KEV listing, and no public exploit code was identified - all three exploitation signals align and point to low real-world exploitation likelihood. No signals conflict here: the low EPSS, absence of KEV, and local-only attack vector are mutually consistent. The practical risk is confined to scenarios where an attacker already has code execution or an app foothold on the victim's device, so this should be patched through normal update cycles rather than treated as an emergency. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app on their Samsung device; that app, running with ordinary privileges, abuses the improper authorization flaw to read personal health data (steps, heart rate, sleep, and other records) managed by Samsung Health without the user's consent. No public exploit code has been identified, and exploitation requires the attacker to already have a local foothold on the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Samsung Health versions prior to 6.30.5.105 allow a local attacker with low-level privileges to bypass authorization and read sensitive health data. The vulnerability requires a pre-existing local foothold, such as a malicious app, and impacts only confidentiality with no integrity or availability loss. With a low EPSS score of 0.12% and no public exploit identified, this is a moderate-severity local information disclosure rather than a widespread remote threat.
RemediationAI
Apply the vendor-released patch by upgrading Samsung Health to version 6.30.5.105 or later via the Galaxy Store or Google Play Store. This is the primary and most effective fix. As a compensating control, users should restrict installation of untrusted apps and review app permissions, since exploitation requires a malicious app already running on the device. No other workarounds are known, but the local attack vector means that keeping the device free of untrusted software reduces risk. Refer to the vendor advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=10 for additional guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Samsung Health is a mobile health and fitness application. The improper authorization flaw, likely a missing or inadequate permission check (CWE-285), lets an attacker-controlled app running on the same device access data that should be protected. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates the attack is local, low complexity, and requires low privileges, meaning any installed app can potentially exploit it without user interaction. The CPE cpe:2.3:a:samsung:health:*:*:*:*:*:*:*:* confirms all versions before 6.30.5.105 are affected. The root cause may be an exported component (e.g., activity, service, or content provider) that does not properly validate the caller's permissions.
Know when Health gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local app-to-app data access on a mobile device, so AV:L and PR:L for an installed unprivileged app; reliably repeatable (AC:L), with data disclosure only (C:H, I:N, A:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Improper authorization in Samsung Health prior to version 6.30.5.105 allows local attackers to access data in Samsung Health.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Improper input validation vulnerability in Samsung Health prior to version 6.24.2.011 allows attackers to write arbitrar
OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Andro
In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the GATT connec
Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action. R
Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker
Caching of GATT characteristic values (TempID) in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to long-term re
The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere
Improper authorization in Samsung Health prior to version 6.30.1.003 allows local attackers to access data in Samsung He
PendingIntent hijacking vulnerability in ChallengeNotificationManager in Samsung Health prior to version 6.25 allows loc
Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive
Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive
Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider
GitHub PoC
Exploit-DB