Improper input validation in Samsung Account prior to version 15.5.01.1

CVE-2025-58486 is an improper input validation flaw (CWE-20) in Samsung Account, the identity-management app pre-installed on every Samsung Galaxy device. Versions prior to 15.5.01.1 fail to sanitize certain inputs, allowing a local process — typically a malicious app already running on the device — to read a small amount of account-related data. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms local access is required, no privileges are needed, and the impact ceiling is low confidentiality with zero integrity or availability effect.

Samsung tagged this MEDIUM at 4.0, which is fair by pure CVSS math. In practice, for an enterprise fleet the rating is generous. The attack surface is a single consumer-oriented mobile app, requires on-device code execution as a prerequisite (meaning the device is already partially compromised), and leaks only low-sensitivity account metadata — not credentials, tokens, or device-management keys. There is no public proof-of-concept, no in-the-wild exploitation, and an EPSS of 0.16% places it well below the noise floor. For a 10,000-host enterprise, this is backlog work.

Why this verdict

• Local prerequisite implies prior compromise. AV:L means the attacker already has code running on the device. In an MDM-managed enterprise fleet with sideloading disabled and Play Protect active, achieving this prerequisite is itself a significant barrier.
• Impact ceiling is C:L with no I or A. Even successful exploitation yields only low-sensitivity account metadata (display name, email). No tokens, no credentials, no device-management keys, no pivot capability.
• Role multiplier: not applicable. Samsung Account is a consumer identity app on mobile handsets. It is not a domain controller, hypervisor, CI/CD system, backup server, PKI, PAM, or network edge appliance. The blast radius is confined to one user's Samsung account metadata on one device — no fleet, domain, or supply-chain impact. Fewer than 0% of installs occupy any high-value infrastructure role. The floor check does not trigger.
• No exploitation pressure. Zero PoC, zero KEV, EPSS at 0.16%. The patch has been available for 8+ months via Galaxy Store auto-update, meaning the vulnerable population is rapidly shrinking.

Why not higher?

Upgrading to MEDIUM or above would require either a broader impact (credential theft, device takeover, MDM bypass), a network-reachable attack surface, evidence of exploitation, or a high-value infrastructure role. None of these conditions are present. The local-only vector on a consumer mobile app with low-confidentiality-only impact does not warrant MEDIUM in an enterprise context.

Why not lower?

IGNORE would be appropriate only if the vulnerability were entirely theoretical or affected zero enterprise devices. Samsung Galaxy devices are common in BYOD and corporate-owned fleets, so some exposure exists. The flaw is real and confirmed by Samsung, just low-impact. LOW captures the residual risk accurately.

1. Verify Samsung Account version via MDM inventory — Query your UEM/MDM (Intune, Workspace ONE, Knox Manage) for devices running Samsung Account < 15.5.01.1 and flag them for app update. No mitigation SLA applies for LOW — treat as backlog hygiene.
2. Enforce Galaxy Store auto-update policy — Ensure managed Samsung devices have Galaxy Store auto-updates enabled so Samsung Account patches deploy without user action. Most devices will already have received 15.5.01.1+ over the past 8 months.
3. Block sideloading on managed devices — Disable installation from unknown sources via MDM policy. This eliminates the primary vector for getting a malicious local app onto the device in the first place.

Run this on a macOS or Linux workstation that has adb connected to the target Samsung device via USB or Wi-Fi debugging. Requires ADB access (developer mode enabled on device). Example: bash check_samsung_account.sh

#!/usr/bin/env bash
# CVE-2025-58486 checker — Samsung Account version via ADB
# Run from workstation with adb connected to target device.
# Output: VULNERABLE / PATCHED / UNKNOWN

set -euo pipefail

PKG="com.osp.app.signin"
FIXED="15.5.01.1"

if ! command -v adb &>/dev/null; then
  echo "UNKNOWN: adb not found in PATH"
  exit 2
fi

VERSION=$(adb shell dumpsys package "$PKG" 2>/dev/null | grep -i versionName | head -1 | sed 's/.*versionName=//' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN: Could not determine Samsung Account version. Is the device connected?"
  exit 2
fi

echo "Detected Samsung Account version: $VERSION"

# Compare versions using sort -V
MIN=$(printf '%s\n%s' "$VERSION" "$FIXED" | sort -V | head -1)

if [ "$MIN" = "$FIXED" ] && [ "$VERSION" != "$FIXED" ]; then
  # VERSION is greater than FIXED
  echo "PATCHED: Samsung Account $VERSION >= $FIXED"
  exit 0
elif [ "$VERSION" = "$FIXED" ]; then
  echo "PATCHED: Samsung Account $VERSION = $FIXED"
  exit 0
else
  echo "VULNERABLE: Samsung Account $VERSION < $FIXED"
  exit 1
fi

Sources

1. SentinelOne Vulnerability Database — CVE-2025-58486
2. OffSeq Threat Radar — CVE-2025-58486
3. OSV — CVE-2025-58486
4. Samsung Mobile Security Scope
5. APKMirror — Samsung Account 15.5.01.1
6. HKCERT — Samsung Products Multiple Vulnerabilities (Sept 2025)
7. CVE Details — Samsung Vulnerabilities