Read the docs
TI-2021-07592 Aliases CVE-2021-25353GHSA-hx6r-fxq2-3wm8

Improper authorization in Samsung Galaxy Themes

Priority LOW 31CWE-285Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Galaxy Themes application without permission via hijacking the PendingIntent.

Why it matters now

EPSS 0.0022 12th percentileScored 2026-11-07
Fix Fixed Galaxy Themes (Samsung Mobile): 5.2.00.1215

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungGalaxy Themesbefore 5.2.00.12155.2.00.1215Patch availableCNA
  • Galaxy Themes VendorSamsung Affected before 5.2.00.1215 Fixed in 5.2.00.1215 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:samsung:galaxy_themes:*:*:*:*:*:*:*:*before 5.2.00.1215VulnerableSamsung
  • cpe:2.3:a:samsung:galaxy_themes:*:*:*:*:*:*:*:* Versions before 5.2.00.1215 Vulnerable ·Samsung

Remediation

  • Fix · CNA Galaxy Themes (Samsung Mobile) Fixed in 5.2.00.1215

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25353
  2. 2026-10-03 Alias added: GHSA-hx6r-fxq2-3wm8

References

Advisory 2

  • TI-2024-13647 Improper verification of intent by broadcast receiver vulnerability in ThemeStore prior… CVSS 3.1MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences