CVE-2025-20903

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-20903 is an improper access control vulnerability affecting the SecSettingsIntelligence component prior to SMR Mar-2025 Release 1. This issue enables local attackers to launch privileged activities, with user interaction required to trigger the vulnerability. The flaw carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE information not available from NVD.

A local attacker with low privileges can exploit this vulnerability by leveraging low attack complexity and inducing user interaction, such as clicking a malicious link or confirming an action. Successful exploitation allows the attacker to execute privileged activities, potentially compromising high levels of confidentiality, integrity, and availability on the affected device.

Samsung's security bulletin for March 2025, available at https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=03, details the vulnerability and recommends updating to SMR Mar-2025 Release 1 or later to mitigate the issue.