TI-2022-09554 Aliases CVE-2022-26090 GHSA-2hgf-c2v6-4f32

Improper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1…

LOW 23CWE-815Published 2022-04-11 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Improper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1 allows that attackers can access contact information without permission.

Why it matters now

EPSS 0.00106 1st percentileScored 2026-11-07

Fix Fixed SamsungContacts (Samsung Mobile): SMR Apr-2022 Release 1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Samsung	SamsungContacts	R(11), S(12) to before SMR Apr-2022 Release 1	SMR Apr-2022 Release 1	Patch available	CNA

SamsungContacts VendorSamsung Affected R(11), S(12) to before SMR Apr-2022 Release 1 Fixed in SMR Apr-2022 Release 1 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:google:android:10.0:::::::*	10.0	Vulnerable	Google
cpe:2.3:o:google:android:11.0:::::::*	11.0	Vulnerable	Google

cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Google
cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Google

Remediation

Fix · CNA SamsungContacts (Samsung Mobile) Fixed in SMR Apr-2022 Release 1

Timeline

2026-10-02 Threatist record created from CVE-2022-26090
2026-10-03 Alias added: GHSA-2hgf-c2v6-4f32

References

Advisory 1

https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4

TI-2025-15039 Out-of-bounds write in Samsung Mobile Devices KEVCVSS 3.1CRITICAL 9.8
TI-2025-15038 Out-of-bounds write in Samsung Mobile Devices KEVCVSS 3.1CRITICAL 9.8
TI-2025-04133 Path traversal in Samsung MagicINFO 9 Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-06858 Path traversal in Samsung MagicINFO 9 Server KEVCVSS 3.1CRITICAL 9.8
TI-2016-00916 Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before… KEVCVSS 3.1HIGH 8.8
TI-2022-06595 An improper check or handling of exceptional conditions in NPU driver prior to SMR… KEVCVSS 3.1HIGH 7.8

See all 2043 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences