Path traversal in Samsung Quick Share Agent
Priority LOW 20CWE-22Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to write file in arbitrary location.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00344 28th percentileScored 2026-11-07
Fix Fixed Quick Share Agent (Samsung Mobile): 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Samsung | Quick Share Agent | — | 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 | Patch available | CNA |
- Quick Share Agent VendorSamsung Affected — Fixed in 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:samsung:quick_share:*:*:*:*:*:*:*:* | before 3.5.19.41 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* | 13.0 | Running on | |
| cpe:2.3:a:samsung:quick_share:*:*:*:*:*:*:*:* | before 3.5.19.42 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:* | 14.0 | Running on | |
| cpe:2.3:a:samsung:quick_share:*:*:*:*:*:*:*:* | before 3.5.14.47 | Vulnerable | Samsung |
| cpe:2.3:o:google:android:12.0:-:*:*:*:*:*:* | 12.0 | Running on |
- cpe:2.3:a:samsung:quick_share:*:*:*:*:*:*:*:* Versions before 3.5.19.41 Vulnerable ·Samsung
- cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* Versions 13.0 Running on ·Google
- cpe:2.3:a:samsung:quick_share:*:*:*:*:*:*:*:* Versions before 3.5.19.42 Vulnerable ·Samsung
- cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:* Versions 14.0 Running on ·Google
- cpe:2.3:a:samsung:quick_share:*:*:*:*:*:*:*:* Versions before 3.5.14.47 Vulnerable ·Samsung
- cpe:2.3:o:google:android:12.0:-:*:*:*:*:*:* Versions 12.0 Running on ·Google
Remediation
- Fix · CNA Quick Share Agent (Samsung Mobile) Fixed in 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14
Timeline
- 2026-10-02 Threatist record created from CVE-2024-49421
- 2026-10-03 Alias added: GHSA-p9xx-363j-2j36
References
More Samsung Quick Share vulnerabilities
- TI-2023-22694 Improper access control vulnerability in Quick Share prior to 13.5.52.0 allows local attacker to access local files. CVSS 3.1MEDIUM 5.5
- TI-2022-12880 Improper access control in Samsung Quick Share CVSS 3.1MEDIUM 5.5
- TI-2022-18854 Improper access control in Samsung QuickShare CVSS 3.1MEDIUM 4.4
- TI-2023-07863 The sensitive information exposure vulnerability in Quick Share Agent prior to versions… CVSS 3.1MEDIUM 4.2
Sources
- CVE-2024-49421 · CVE Program
- CVE-2024-49421 · NVD
- FIRST EPSS
- GHSA-p9xx-363j-2j36 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences