Security readout for executives and security teams
Plain-English summary
This Samsung Mobile driver flaw was fixed in the May 2021 security release. If an attacker already has compromised radio-level privilege, a race condition in the MFC charger driver can allow arbitrary write with serious device impact.
Executive priority
Treat this as high priority for legacy Samsung device fleets because it is in CISA KEV. The vulnerability is not broadly remote by itself, but known exploitation and high impact justify rapid patch verification or device retirement.
Technical view
CVE-2021-25394 is a CWE-416 use-after-free race condition in Samsung's MFC charger driver before SMR MAY-2021 Release 1. The CVSS vector is local, high complexity, high privileges, no user interaction, with high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most relevant to Samsung Mobile Devices on Android O, P, Q, or R that have not received SMR MAY-2021 Release 1 or later. Managed fleets with legacy or unpatched Samsung devices should be reviewed first.
Exploitation context
CISA KEV inclusion indicates known exploitation. The provided sources do not describe exploit scale, targets, tooling, or whether exploitation was standalone or part of a chain. The vulnerability requires compromised radio privilege, which limits casual exploitation but matters in advanced scenarios.
Researcher notes
The key constraint is the prerequisite radio privilege compromise. Public bundle evidence supports arbitrary write via a race-condition use-after-free in the MFC charger driver, but does not provide exploit mechanics, affected model granularity, or post-fix code detail.
Mitigation direction
- Apply Samsung SMR MAY-2021 Release 1 or later to affected devices.
- Check current Samsung guidance for model-specific update availability.
- Prioritize patch verification for managed, high-risk, or legacy Samsung devices.
- Retire or restrict devices that cannot receive the fixed security release.
Validation and detection
- Inventory Samsung Mobile devices running Android O, P, Q, or R.
- Confirm each device security patch level includes SMR MAY-2021 Release 1 or later.
- Use MDM or EMM reporting to identify noncompliant devices.
- Review mobile security telemetry for unusual radio/baseband compromise indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-25394 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.4 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H0.55.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.4MediumVector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5CVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25394CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.