TI-2022-07957 Aliases CVE-2022-23995 GHSA-7mpc-29w7-wf38

Improper access control in Samsung Wearable Devices

LOW 19CWE-284Published 2022-02-11 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to change bedtime mode without a proper permission.

Why it matters now

EPSS 0.00438 38th percentileScored 2026-11-07

Fix Fixed Samsung Wearable Devices (Samsung Mobile): Firmware update Feb-2022 Release

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Samsung	Samsung Wearable Devices	Wear OS 3.0 to before Firmware update Feb-2022 Release	Firmware update Feb-2022 Release	Patch available	CNA

Samsung Wearable Devices VendorSamsung Affected Wear OS 3.0 to before Firmware update Feb-2022 Release Fixed in Firmware update Feb-2022 Release Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:samsung:wear_os::::::::	before 3.0	Vulnerable	Samsung

cpe:2.3:o:samsung:wear_os:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Samsung

Remediation

Fix · CNA Samsung Wearable Devices (Samsung Mobile) Fixed in Firmware update Feb-2022 Release

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-02-11
Samsung Wearable Devices Firmware update Feb-2022 Release
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2022-07959 Improper access control in Samsung Wearable DevicesPriority LOW 19
- TI-2022-07958 Improper access control in Samsung Wearable DevicesPriority LOW 19
- TI-2022-07956 Improper access control in Samsung Wearable DevicesPriority LOW 16
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-23995
2026-10-03 Alias added: GHSA-7mpc-29w7-wf38

References

Advisory 1

https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=2

TI-2025-14942 Improper handling of exceptional conditions in pairing specific bluetooth devices in… CVSS 3.1HIGH 8.8
TI-2025-14980 Incorrect default permissions in Samsung Mobile Devices CVSS 3.1MEDIUM 6.8
TI-2025-14993 Incorrect default permission in Framework for Galaxy Watch prior to SMR Jul-2025 Release… CVSS 3.1MEDIUM 6.2
TI-2025-14941 Insecure storage of sensitive information in Samsung Mobile Devices CVSS 3.1MEDIUM 6.2
TI-2025-14908 Insecure storage of sensitive information in Samsung Mobile Devices CVSS 3.1MEDIUM 6.2
TI-2025-14906 Incorrect default permissions in Samsung Mobile Devices CVSS 3.1MEDIUM 6.2

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences