CVE-2023-42553

Vulnerability

An improper authorization verification vulnerability exists in Samsung Email prior to version 6.1.90.4 [1]. The flaw resides in the authorization logic, allowing an attacker to bypass checks and access sandbox data of the email application. The vulnerability is present in all versions before the fix.

Exploitation

An attacker with local access to the device or the ability to execute code within the Samsung Email process can exploit this vulnerability. No user interaction is required beyond the attacker having the necessary permissions to run code on the device. The attacker can trigger the improper authorization path to read the sandbox data.

Impact

Successful exploitation allows the attacker to read the sandbox data of Samsung Email, which may contain sensitive email content, attachments, and other private information. This constitutes a confidentiality breach.

Mitigation

The vulnerability is fixed in Samsung Email version 6.1.90.4 [1]. Users should update the application via the Samsung Store to the latest version. No workarounds are available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.