Improper input validation in Samsung Camera
Priority LOW 28CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) allows untrusted applications to take a picture in screenlock status.
Why it matters now
EPSS 0.00586 48th percentileScored 2026-11-07
Fix Fixed Samsung Camera (Samsung Mobile): 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9)
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Samsung | Samsung Camera | - to before 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) | 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) | Patch available | CNA |
- Samsung Camera VendorSamsung Affected - to before 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) Fixed in 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:samsung:camera:*:*:*:*:*:*:*:* | before 11.1.02.16 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* | 11.0 | Running on | |
| cpe:2.3:a:samsung:camera:*:*:*:*:*:*:*:* | before 10.5.03.77 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:* | 10.0 | Running on | |
| cpe:2.3:a:samsung:camera:*:*:*:*:*:*:*:* | before 9.0.6.68 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:* | 9.0 | Running on |
- cpe:2.3:a:samsung:camera:*:*:*:*:*:*:*:* Versions before 11.1.02.16 Vulnerable ·Samsung
- cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* Versions 11.0 Running on ·Google
- cpe:2.3:a:samsung:camera:*:*:*:*:*:*:*:* Versions before 10.5.03.77 Vulnerable ·Samsung
- cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:* Versions 10.0 Running on ·Google
- cpe:2.3:a:samsung:camera:*:*:*:*:*:*:*:* Versions before 9.0.6.68 Vulnerable ·Samsung
- cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Google
Remediation
- Fix · CNA Samsung Camera (Samsung Mobile) Fixed in 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9)
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23998
- 2026-10-03 Alias added: GHSA-m2w8-37g8-4987
References
More Samsung Camera vulnerabilities
- TI-2023-07883 Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11… CVSS 3.1MEDIUM 6.1
- TI-2024-13648 Improper handling of insufficient privileges vulnerability in Samsung Camera prior to… CVSS 3.1MEDIUM 5.9
- TI-2022-14830 Improper authorization in Samsung Camera CVSS 3.1MEDIUM 5.3
- TI-2023-14544 Implicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android… CVSS 3.1MEDIUM 5.5
- TI-2026-17031 Improper access control in Samsung Camera prior to version 16.5.00.28 allows local… CVSS 4.0MEDIUM 5.1
Sources
- CVE-2022-23998 · CVE Program
- CVE-2022-23998 · NVD
- FIRST EPSS
- GHSA-m2w8-37g8-4987 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences