CVE-2025-2233

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2233
Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Samsung SmartThings. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Hub Local API service, which listens on TCP port 8766 by default. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25615.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.zerodayinitiative.com/advisories/ZDI-25-127/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:samsung:smartthings:*:*:*:*:*:*:*:*
History

08 Aug 2025, 01:25

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de omisión de autenticación de firma criptográfica y verificación incorrecta en Samsung SmartThings. Esta vulnerabilidad permite a atacantes adyacentes a la red omitir la autenticación en las instalaciones afectadas de Samsung SmartThings. No se requiere autenticación para explotar esta vulnerabilidad. La falla específica se encuentra en el servicio Hub Local API, que escucha en el puerto TCP 8766 por defecto. El problema se debe a la falta de verificación adecuada de una firma criptográfica. Un atacante puede aprovechar esta vulnerabilidad para omitir la autenticación en el sistema. Anteriormente, se denominó ZDI-CAN-25615.
References () https://www.zerodayinitiative.com/advisories/ZDI-25-127/ - () https://www.zerodayinitiative.com/advisories/ZDI-25-127/ - Third Party Advisory
First Time Samsung smartthings
Samsung
CPE cpe:2.3:a:samsung:smartthings:*:*:*:*:*:*:*:*

11 Mar 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-11 23:15

Updated : 2025-08-08 01:25

NVD link : CVE-2025-2233

Mitre link : CVE-2025-2233

CVE.ORG link : CVE-2025-2233

JSON object : View

Products Affected

samsung

  • smartthings
CWE
CWE-347

Improper Verification of Cryptographic Signature