Read the docs
TI-2022-11420 Aliases CVE-2022-28793GHSA-cx8v-4599-xpcf

Improper check for unusual conditions in Samsung Mobile Devices

Priority LOW 20CWE-754Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot cycle after compromising TEE. The patch is applied in Galaxy S22 to prevent change of Android ROT after first initialization at boot time.

Why it matters now

EPSS 0.00218 12th percentileScored 2026-11-07
Fix Fixed Samsung Mobile Devices (Samsung Mobile): Galaxy S22

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungSamsung Mobile Devices- to before Galaxy S22Galaxy S22Patch availableCNA
  • Samsung Mobile Devices VendorSamsung Affected - to before Galaxy S22 Fixed in Galaxy S22 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:samsung:galaxy_s22_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSamsung
cpe:2.3:h:samsung:galaxy_s22:-:*:*:*:*:*:*:*not specified by NVDRunning onSamsung
  • cpe:2.3:o:samsung:galaxy_s22_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Samsung
  • cpe:2.3:h:samsung:galaxy_s22:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Samsung

Remediation

  • Fix · CNA Samsung Mobile Devices (Samsung Mobile) Fixed in Galaxy S22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28793
  2. 2026-10-03 Alias added: GHSA-cx8v-4599-xpcf

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences