TI-2023-07851 Aliases CVE-2023-21450 GHSA-ch9w-9hvx-qfxx

Missing authorization in Samsung One Hand Operation +

LOW 12CWE-862Published 2023-02-09 · Updated 2025-03-24

Key facts

Attack vector: Physical
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner's widget without authorization via gesture setting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00285 21st percentileScored 2026-11-07

Fix Fixed One Hand Operation + (Samsung Mobile): 6.1.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Samsung	One Hand Operation +	before 6.1.21	6.1.21	Patch available	CNA

One Hand Operation + VendorSamsung Affected before 6.1.21 Fixed in 6.1.21 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:samsung:one_hand_operation_\+::::::android::*	before 6.1.21	Vulnerable	Samsung

cpe:2.3:a:samsung:one_hand_operation_\+:*:*:*:*:*:android:*:* Versions before 6.1.21 Vulnerable ·Samsung

Remediation

Fix · CNA One Hand Operation + (Samsung Mobile) Fixed in 6.1.21

Timeline

2026-10-02 Threatist record created from CVE-2023-21450
2026-10-03 Alias added: GHSA-ch9w-9hvx-qfxx

References

Advisory 1

https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=02

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences