Samsung FactoryCamera CVE-2026-21015

Q: What is the CVSS score of CVE-2026-21015?

CVE-2026-21015 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29902 MEDIUM

Incorrect Default Permissions (CWE-276)

2026-05-13 SamsungMobile

GHSA-9fcc-wcwf-36w9

Privilege Escalation Samsung Mobile Devices

6.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local low-privilege attacker reads a unique identifier with no integrity or availability impact and no scope change beyond the vulnerable app.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:00 vuln.today

CVE Published

May 13, 2026 - 04:56 cve.org

MEDIUM 6.8

CVE Published

May 13, 2026 - 04:56 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.

AnalysisAI

FactoryCamera on Samsung Mobile Devices prior to SMR May-2026 Release 1 exposes a unique device identifier to local low-privileged attackers due to incorrect default file or resource permissions (CWE-276). Affected platforms span Android 14, 15, and 16. The vulnerability carries a CVSS 4.0 score of 6.8 with high confidentiality impact on the vulnerable system, though real-world risk is substantially tempered by the requirement for local device access, an EPSS of 0.01% (1st percentile), and SSVC classification of exploitation: none. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

CWE-276 (Incorrect Default Permissions) describes a class of vulnerabilities where software components ship with file, directory, or resource permissions that are more permissive than the principle of least privilege demands. In this case, FactoryCamera - a pre-installed Samsung OEM camera application present on Samsung Mobile Devices - fails to restrict access to a unique device identifier at the OS permission layer. The affected CPE is cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:*, covering the broad Samsung Mobile Devices product line. On Android, such identifiers (e.g., hardware serial numbers, device-specific tokens, or factory calibration IDs) are typically protected by OS-level permissions or app sandboxing; a misconfigured default permission on a file, content provider, or broadcast receiver can allow any co-resident low-privileged application to read these values without explicit user consent or elevated privilege.

RemediationAI

Apply the Samsung SMR May-2026 Release 1 security update, which corrects the default permission assignment in FactoryCamera. This update is available through standard Samsung OTA update mechanisms for devices running Android 14, 15, and 16. Reference the official advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=05. For devices that cannot immediately receive the patch (e.g., enterprise-managed devices awaiting MDM-distributed updates), a compensating control is to restrict sideloaded or untrusted application installation via MDM policy, as exploitation requires a co-resident low-privileged app. Disabling or restricting FactoryCamera is not a practical workaround on Samsung devices where it is a core factory diagnostic component, but Mobile Threat Defense solutions can be used to detect unusual inter-app data access patterns in the interim.