Read the docs
TI-2022-11416 Aliases CVE-2022-28789GHSA-v28m-q3p8-g67p

Missing authorization in Samsung Voice Note

Priority LOW 27CWE-862Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interaction. The patch adds proper permission for vulnerable activities.

Why it matters now

EPSS 0.00209 11th percentileScored 2026-11-07
Fix Fixed Voice Note (Samsung Mobile): 21.3.51.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungVoice Note- to before 21.3.51.1121.3.51.11Patch availableCNA
  • Voice Note VendorSamsung Affected - to before 21.3.51.11 Fixed in 21.3.51.11 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:samsung:voice_note:*:*:*:*:*:*:*:*before 21.3.51.11VulnerableSamsung
  • cpe:2.3:a:samsung:voice_note:*:*:*:*:*:*:*:* Versions before 21.3.51.11 Vulnerable ·Samsung

Remediation

  • Fix · CNA Voice Note (Samsung Mobile) Fixed in 21.3.51.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28789
  2. 2026-10-03 Alias added: GHSA-v28m-q3p8-g67p

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences