Read the docs
TI-2022-17045 Aliases CVE-2022-36830GHSA-pvc4-x6fm-w5wg

PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to…

Priority LOW 27CWE-927Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via implicit intent.

Why it matters now

EPSS 0.00177 7th percentileScored 2026-11-07
Fix Fixed Charm by Samsung (Samsung Mobile): 1.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungCharm by Samsungbefore 1.2.31.2.3Patch availableCNA
  • Charm by Samsung VendorSamsung Affected before 1.2.3 Fixed in 1.2.3 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:samsung:charm_firmware:*:*:*:*:*:*:*:*before 1.2.3VulnerableSamsung
cpe:2.3:h:samsung:charm:-:*:*:*:*:*:*:*not specified by NVDRunning onSamsung
  • cpe:2.3:o:samsung:charm_firmware:*:*:*:*:*:*:*:* Versions before 1.2.3 Vulnerable ·Samsung
  • cpe:2.3:h:samsung:charm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Samsung

Remediation

  • Fix · CNA Charm by Samsung (Samsung Mobile) Fixed in 1.2.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Samsung Mobile Charm by Samsung 1.2.3

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2022-17051 Missing authorization in Samsung Charm by SamsungPriority LOW 27
    • TI-2022-17044 PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to…Priority LOW 27
    • TI-2022-14852 Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to…Priority LOW 27
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36830
  2. 2026-10-03 Alias added: GHSA-pvc4-x6fm-w5wg

References

Advisory 1

  • TI-2022-17051 Missing authorization in Samsung Charm by Samsung CVSS 3.1MEDIUM 6.2
  • TI-2022-17044 PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to… CVSS 3.1MEDIUM 6.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences