CVE-2019-6741

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-03 · updated 2026-06-17
Weakness: CWE-601

Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467). User interaction is required to exploit this vulnerability in that the target must connect to a wireless network. The specific flaw exists within the captive portal. By manipulating HTML, an attacker can force a page redirection. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7476.

Affected products

Samsung Galaxy S9: before 2019-01 — fixed in 2019-01

How to fix

Upgrade to a fixed version: Samsung Galaxy S9 2019-01. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-6741 or the next vulnerability affects your stack