What’s Vulnerable › Vulnerabilities

CVE-2021-25424

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-11 · updated 2026-06-17
• Weakness: CWE-287

Description

Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take over the user's bluetooth device without user awareness.

Affected products

• Samsung Galaxy Watch 3 Firmware: before 5.5 — fixed in 5.5
• Samsung Galaxy Watch Active 2 Firmware: before 5.5 — fixed in 5.5
• Samsung Galaxy Watch Active Firmware: before 5.5 — fixed in 5.5
• Samsung Galaxy Watch Firmware: before 5.5 — fixed in 5.5
• Samsung Gear 2 Firmware: before 5.5 — fixed in 5.5
• Samsung Gear 2 Neo Firmware: before 5.5 — fixed in 5.5
• Samsung Gear S2 Firmware: before 5.5 — fixed in 5.5
• Samsung Gear S3 Firmware: before 5.5 — fixed in 5.5
• Samsung Gear S Firmware: before 5.5 — fixed in 5.5

How to fix

Upgrade to a fixed version: Samsung Galaxy Watch 3 Firmware 5.5; Samsung Galaxy Watch Active 2 Firmware 5.5; Samsung Galaxy Watch Active Firmware 5.5; Samsung Galaxy Watch Firmware 5.5; Samsung Gear 2 Firmware 5.5; Samsung Gear 2 Neo Firmware 5.5; Samsung Gear S2 Firmware 5.5; Samsung Gear S3 Firmware 5.5; Samsung Gear S Firmware 5.5. Check the vendor advisory for mitigations.

References

• https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6
• https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6

Get alerted when CVE-2021-25424 or the next vulnerability affects your stack