CVE-2017-18648

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-07 · updated 2026-06-17
Weakness: CWE-20

Description

An issue was discovered on Samsung mobile devices with KK(4.4.x), L(5.x), M(6.x), and N(7.x) software. Arbitrary file read/write operations can occur in the locked state via a crafted MTP command. The Samsung ID is SVE-2017-10086 (November 2017).

Affected products

Android: 4.4, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 5.0 (+11)

References

https://security.samsungmobile.com/securityUpdate.smsb
https://security.samsungmobile.com/securityUpdate.smsb

Get alerted when CVE-2017-18648 or the next vulnerability affects your stack