Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• samsung emailbefore 6.1.82.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Samsung Mobile). Independent of NVD's CPE analysis and usually ahead of it.

• Samsung Mobile Samsung Email

  • 6.1.82.0not affected

Other highest-scoring records for the same primary product.

• CVE-2021-25375Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another ema
  26Monitor
• CVE-2024-34636Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to get sensitive inform
  22Monitor
• CVE-2024-20867Improper privilege management vulnerability in Samsung Email prior to version 6.1.91.14 allows local attackers to access sensitive informati
  22Monitor
• CVE-2023-42553Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email.
  21Monitor
• CVE-2021-25376An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTL
  21Monitor
• CVE-2025-20894Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles.
  18Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.