Read the docs
TI-2022-17051 Aliases CVE-2022-36836GHSA-88h8-4hc5-65ch

Missing authorization in Samsung Charm by Samsung

Priority LOW 27CWE-862Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Unprotected provider vulnerability in Charm by Samsung prior to version 1.2.3 allows attackers to read connection state without permission.

Why it matters now

EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed Charm by Samsung (Samsung Mobile): 1.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungCharm by Samsungbefore 1.2.31.2.3Patch availableCNA
  • Charm by Samsung VendorSamsung Affected before 1.2.3 Fixed in 1.2.3 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:samsung:charm_firmware:*:*:*:*:*:*:*:*before 1.2.3VulnerableSamsung
cpe:2.3:h:samsung:charm:-:*:*:*:*:*:*:*not specified by NVDRunning onSamsung
  • cpe:2.3:o:samsung:charm_firmware:*:*:*:*:*:*:*:* Versions before 1.2.3 Vulnerable ·Samsung
  • cpe:2.3:h:samsung:charm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Samsung

Remediation

  • Fix · CNA Charm by Samsung (Samsung Mobile) Fixed in 1.2.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Samsung Mobile Charm by Samsung 1.2.3

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2022-17045 PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to…Priority LOW 27
    • TI-2022-17044 PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to…Priority LOW 27
    • TI-2022-14852 Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to…Priority LOW 27
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36836
  2. 2026-10-03 Alias added: GHSA-88h8-4hc5-65ch

References

Advisory 1

  • TI-2022-17045 PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to… CVSS 3.1MEDIUM 6.2
  • TI-2022-17044 PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to… CVSS 3.1MEDIUM 6.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences