Security readout for executives and security teams
Plain-English summary
CVE-2020-10847 is a Samsung mobile device issue where facial recognition on Android 9.0 Galaxy S8 and Note8 software could be spoofed. The public record does not provide CVSS severity, attack detail, or confirmed exploitation. Treat it as a physical-access authentication weakness rather than a broad remote compromise issue.
Executive priority
Prioritize as a targeted mobile-device hygiene issue, especially for executives, admins, and staff handling sensitive data on older Samsung phones. It is not presented as actively exploited in the provided sources.
Technical view
The CVE describes spoofable facial recognition on Samsung Galaxy S8 and Note8 devices running P(9.0). Samsung tracks it as SVE-2019-16614 in the February 2020 update cycle. The source bundle does not identify a CWE, score, exploit prerequisites, or detailed vulnerable build ranges beyond the device/software description.
Likely exposure
Exposure is most likely limited to managed or personally used Galaxy S8 and Note8 devices still running Android 9.0-era software without the relevant Samsung update confirmed.
Exploitation context
The bundle does not show CISA KEV listing or any cited evidence of active exploitation. Because the issue concerns facial recognition spoofing, realistic risk likely depends on physical access to the device and whether facial unlock is enabled.
Researcher notes
Evidence is sparse: no CVSS, CWE, exploit detail, or full affected build list is present. Analysis should stay anchored to Samsung SVE-2019-16614 and avoid broader Samsung or Android claims without additional vendor documentation.
Mitigation direction
- Check Samsung guidance for SVE-2019-16614 and the February 2020 update cycle.
- Inventory Galaxy S8 and Note8 devices running Android 9.0/P software.
- Confirm affected devices have the relevant Samsung security update installed.
- Disable facial recognition where stronger unlock methods are required by policy.
- Retire or restrict devices that cannot be verified as updated.
Validation and detection
- Use MDM inventory to find Galaxy S8 and Note8 models and OS versions.
- Record each device security patch level and Samsung firmware status.
- Confirm whether facial recognition unlock is enabled on in-scope devices.
- Map findings against Samsung’s SVE-2019-16614 guidance.
- Document exceptions for unsupported or unmanaged devices.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-10847 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://security.samsungmobile.com/securityUpdate.smsbCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.