GCVE - cpe:2.3:a:samsung:smartthings:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:samsung:smartthings:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Samsung (`0eb241f7-997b-5d1c-b2a3-00a89e1049d3`)
Product	Smartthings (`78e57b21-3148-5a33-a474-ce561956ce6c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-2233`	vulnerable	2026-06-08 07:16:56.531408	Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability HIGH (8.8) Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Samsung SmartThings. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Hub Local API service, which listens on TCP port 8766 by default. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25615. Published: 2025-03-11T22:30:44.003Z Updated: 2026-02-26T19:09:35.917Z Open on db.gcve.eu Reference links https://www.zerodayinitiative.com/advisories/ZDI-25-127/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-49416`	vulnerable	2026-06-08 06:50:14.119066	Details available MEDIUM (4) Use of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows local attackers to get sensitive information. Published: 2024-12-03T05:47:59.990Z Updated: 2024-12-03T11:43:45.274Z Open on db.gcve.eu Reference links https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-34596`	vulnerable	2026-06-08 06:37:33.807315	Details available MEDIUM (5.9) Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner. Published: 2024-07-02T09:23:36.232Z Updated: 2024-08-02T02:59:21.931Z Open on db.gcve.eu Reference links https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=07	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-20852`	vulnerable	2026-06-08 06:27:31.154128	Details available MEDIUM (5.9) Improper verification of intent by broadcast receiver vulnerability in SmartThings prior to version 1.8.13.22 allows local attackers to access testing configuration. Published: 2024-04-02T02:59:48.487Z Updated: 2024-08-01T22:06:36.637Z Open on db.gcve.eu Reference links https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25378`	vulnerable	2026-06-08 05:30:40.878613	Details available MEDIUM (4.3) Improper access control of certain port in SmartThings prior to version 1.7.63.6 allows remote temporary denial of service. Published: 2021-04-09T17:39:44.000Z Updated: 2024-08-03T20:03:05.621Z Open on db.gcve.eu Reference links https://security.samsungmobile.com/ https://security.samsungmobile.com/serviceWeb.smsb	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.