Samsung Mobile Devices known exploited vulnerabilities, ranked
CISA lists 13 Samsung Mobile Devices CVEs as exploited in the wild. 2 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2025-21042: EPSS 33.2%, added 2025-11-10
- CVE-2021-25337: EPSS 2.8%, added 2022-11-08
- CVE-2023-21492: EPSS 2.6%, added 2023-05-19
- CVE-2025-21043: EPSS 2.1%, added 2025-10-02
- CVE-2021-25369: EPSS 1.1%, added 2022-11-08
All 13 Samsung Mobile Devices CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-21042 | Mobile Devices Out-of-Bounds Write | 33.2% | – | 2025-11-10 | 2025-12-01 |
| 2 | CVE-2021-25337 | Mobile Devices Improper Access Control | 2.8% | – | 2022-11-08 | 2022-11-29 |
| 3 | CVE-2023-21492 | Mobile Devices Insertion of Sensitive Information Into Log File | 2.6% | – | 2023-05-19 | 2023-06-09 |
| 4 | CVE-2025-21043 | Mobile Devices Out-of-Bounds Write | 2.1% | – | 2025-10-02 | 2025-10-23 |
| 5 | CVE-2021-25369 | Mobile Devices Improper Access Control | 1.1% | – | 2022-11-08 | 2022-11-29 |
| 6 | CVE-2021-25370 | Mobile Devices Memory Corruption | 0.9% | – | 2022-11-08 | 2022-11-29 |
| 7 | CVE-2021-25372 | Mobile Devices Improper Boundary Check | 0.8% | – | 2023-06-29 | 2023-07-20 |
| 8 | CVE-2021-25371 | Mobile Devices Unspecified | 0.8% | – | 2023-06-29 | 2023-07-20 |
| 9 | CVE-2021-25487 | Mobile Devices Out-of-Bounds Read | 0.6% | – | 2023-06-29 | 2023-07-20 |
| 10 | CVE-2021-25489 | Mobile Devices Improper Input Validation | 0.5% | – | 2023-06-29 | 2023-07-20 |
| 11 | CVE-2021-25394 | Mobile Devices Race Condition | 0.4% | – | 2023-06-29 | 2023-07-20 |
| 12 | CVE-2022-22265 | Mobile Devices Use-After-Free | 0.4% | – | 2023-09-18 | 2023-10-09 |
| 13 | CVE-2021-25395 | Mobile Devices Race Condition | 0.4% | – | 2023-06-29 | 2023-07-20 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Samsung KEV CVEs · free KEV badge for Samsung · all vendors